PHP 5.2.1 allows context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with S:, which does not properly track the number of input bytes being processed.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.2.  It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer overflow vulnerability was found     in PHP's gd extension. A script that could be forced to     process WBMP images from an untrusted source could     result in arbitrary code execution. (CVE-2007-1001)

  - A vulnerability in the way the mbstring extension     setglobal variables was discovered where a script using     the mb_parse_str() function to set global variables     could be forced to to enable the register_globals     configuration option, possibly resulting in global     variable injection. (CVE-2007-1583)

  - A context-dependent attacker could read portions of     heap memory by executing certain scripts with a     serialized data input string beginning with 'S:', which     did not properly track the number of input bytes being     processed. (CVE-2007-1649)

  - A vulnerability in how PHP's mail() function processed     email messages, truncating potentially important     information after the first ASCIIZ (\0) byte.
    (CVE-2007-1717)

  - A vulnerability in how PHP's mail() function processed     header data was discovered. If a script sent mail using     a subject header containing a string from an untrusted     source, a remote attacker could send bulk email to     unintended recipients (CVE-2007-1718).

A number of vulnerabilities have been found and corrected in PHP :

PHP 5.2.1 would allow context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with 'S:', which did not properly track the number of input bytes being processed (CVE-2007-1649).

A vulnerability in the chunk_split() function in PHP prior to 5.2.4 has unknown impact and attack vectors, related to an incorrect size calculation (CVE-2007-4660).

The htmlentities() and htmlspecialchars() functions in PHP prior to 5.2.5 accepted partial multibyte sequences, which has unknown impact and attack vectors (CVE-2007-5898).

The output_add_rewrite_var() function in PHP prior to 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which could allow a remote attacker to obtain potentially sensitive information by reading the requests for this URL (CVE-2007-5899).

The escapeshellcmd() API function in PHP prior to 5.2.6 has unknown impact and context-dependent attack vectors related to incomplete multibyte characters (CVE-2008-2051).

Weaknesses in the GENERATE_SEED macro in PHP prior to 4.4.8 and 5.2.5 were discovered that could produce a zero seed in rare circumstances on 32bit systems and generations a portion of zero bits during conversion due to insufficient precision on 64bit systems (CVE-2008-2107, CVE-2008-2108).

The IMAP module in PHP uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) via a long IMAP request (CVE-2008-2829).

The updated packages have been patched to correct these issues.

The remote host is running a version of PHP lower than 4.4.7 or 5.2.2.  This version is vulnerable to a number of remote issues.  At least one of these issues is related to a buffer overflow attack.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	Name	Product	Family	Severity
17797	PHP 5.x < 5.2.2 Multiple vulnerabilities	Nessus	CGI abuses	high
37584	Mandriva Linux Security Advisory : php (MDVSA-2008:126)	Nessus	Mandriva Local Security Checks	critical
3982	PHP 4.x < 4.4.7 / 5.x < 5.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2007-1649

high

Tenable Plugins

high

critical

high