The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION, which destroys the session data Hashtable.

This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the 'Month of PHP Bugs'. The vulnerabilities potentially lead to crashes, information leaks or even execution of malicious code.

CVE-2007-1380 / CVE-2007-0988 / CVE-2007-1375 / CVE-2007-1521 / CVE-2007-1376 / CVE-2007-1583 / CVE-2007-1461 / CVE-2007-1484 / CVE-2007-1700 / CVE-2007-1717 / CVE-2007-1718 / CVE-2007-1001 / CVE-2007-1824

Stefan Esser discovered multiple vulnerabilities in the 'Month of PHP bugs'.

The substr_compare() function did not sufficiently verify its length argument. This might be exploited to read otherwise unaccessible memory, which might lead to information disclosure. (CVE-2007-1375)

The shared memory (shmop) functions did not verify resource types, thus they could be called with a wrong resource type that might contain user-supplied data. This could be exploited to read and write arbitrary memory addresses of the PHP interpreter. This issue does not affect Ubuntu 7.04. (CVE-2007-1376)

The php_binary handler of the session extension was missing a boundary check. When unserializing overly long variable names this could be exploited to read up to 126 bytes of memory, which might lead to information disclosure. (CVE-2007-1380)

The internal array_user_key_compare() function, as used for example by the PHP function uksort(), incorrectly handled memory unreferencing of its arguments. This could have been exploited to execute arbitrary code with the privileges of the PHP interpreter, and thus circumventing any disable_functions, open_basedir, or safe_mode restrictions. (CVE-2007-1484)

The session_regenerate_id() function did not properly clean up the former session identifier variable. This could be exploited to crash the PHP interpreter, possibly also remotely. (CVE-2007-1521)

Under certain conditions the mb_parse_str() could cause the register_globals configuration option to become permanently enabled.
This opened an attack vector for a large and common class of vulnerabilities. (CVE-2007-1583)

The session extension did not set the correct reference count value for the session variables. By unsetting _SESSION and HTTP_SESSION_VARS (or tricking a PHP script into doing that) this could be exploited to execute arbitrary code with the privileges of the PHP interpreter.
This issue does not affect Ubuntu 7.04. (CVE-2007-1700)

The mail() function did not correctly escape control characters in multiline email headers. This could be remotely exploited to inject arbitrary email headers. (CVE-2007-1718)

The php_stream_filter_create() function had an off-by-one buffer overflow in the handling of wildcards. This could be exploited to remotely crash the PHP interpreter. This issue does not affect Ubuntu 7.04. (CVE-2007-1824)

When calling the sqlite_udf_decode_binary() with special arguments, a buffer overflow happened. Depending on the application this could be locally or remotely exploited to execute arbitrary code with the privileges of the PHP interpreter. (CVE-2007-1887 CVE-2007-1888)

The FILTER_VALIDATE_EMAIL filter extension used a wrong regular expression that allowed injecting a newline character at the end of the email string. This could be exploited to inject arbitrary email headers. This issue only affects Ubuntu 7.04. (CVE-2007-1900).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the 'Month of PHP Bugs'. The vulnerabilities potentially lead to crashes, information leaks or even execution of malicious code.

CVE-2007-1380, CVE-2007-0988, CVE-2007-1375, CVE-2007-1454 CVE-2007-1453, CVE-2007-1521, CVE-2007-1522, CVE-2007-1376 CVE-2007-1583, CVE-2007-1460, CVE-2007-1461, CVE-2007-1484 CVE-2007-1700, CVE-2007-1717, CVE-2007-1718, CVE-2007-1001 CVE-2007-1824, CVE-2007-1889, CVE-2007-1900

The remote host is affected by the vulnerability described in GLSA-200705-19 (PHP: Multiple vulnerabilities)

    Several vulnerabilities were found in PHP, most of them during the     Month Of PHP Bugs (MOPB) by Stefan Esser. The most severe of these     vulnerabilities are integer overflows in wbmp.c from the GD library     (CVE-2007-1001) and in the substr_compare() PHP 5 function     (CVE-2007-1375). Ilia Alshanetsky also reported a buffer overflow in     the make_http_soap_request() and in the user_filter_factory_create()     functions (CVE-2007-2510, CVE-2007-2511), and Stanislav Malyshev     discovered another buffer overflow in the bundled XMLRPC library     (CVE-2007-1864). Additionally, the session_regenerate_id() and the     array_user_key_compare() functions contain a double-free vulnerability     (CVE-2007-1484, CVE-2007-1521). Finally, there exist implementation     errors in the Zend engine, in the mb_parse_str(), the unserialize() and     the mail() functions and other elements.
  Impact :

    Remote attackers might be able to exploit these issues in PHP     applications making use of the affected functions, potentially     resulting in the execution of arbitrary code, Denial of Service,     execution of scripted contents in the context of the affected site,     security bypass or information leak.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1286     Stefan Esser discovered an overflow in the object     reference handling code of the unserialize() function,     which allows the execution of arbitrary code if     malformed input is passed from an application.

  - CVE-2007-1375     Stefan Esser discovered that an integer overflow in the     substr_compare() function allows information disclosure     of heap memory.

  - CVE-2007-1376     Stefan Esser discovered that insufficient validation of     shared memory functions allows the disclosure of heap     memory.

  - CVE-2007-1380     Stefan Esser discovered that the session handler     performs insufficient validation of variable name length     values, which allows information disclosure through a     heap information leak.

  - CVE-2007-1453     Stefan Esser discovered that the filtering framework     performs insufficient input validation, which allows the     execution of arbitrary code through a buffer underflow.

  - CVE-2007-1454     Stefan Esser discovered that the filtering framework can     be bypassed with a special whitespace character.

  - CVE-2007-1521     Stefan Esser discovered a double free vulnerability in     the session_regenerate_id() function, which allows the     execution of arbitrary code.

  - CVE-2007-1583     Stefan Esser discovered that a programming error in the     mb_parse_str() function allows the activation of     'register_globals'.

  - CVE-2007-1700     Stefan Esser discovered that the session extension     incorrectly maintains the reference count of session     variables, which allows the execution of arbitrary code.

  - CVE-2007-1711     Stefan Esser discovered a double free vulnerability in     the session management code, which allows the execution     of arbitrary code.

  - CVE-2007-1718     Stefan Esser discovered that the mail() function     performs insufficient validation of folded mail headers,     which allows mail header injection.

  - CVE-2007-1777     Stefan Esser discovered that the extension to handle ZIP     archives performs insufficient length checks, which     allows the execution of arbitrary code.

  - CVE-2007-1824     Stefan Esser discovered an off-by-one error in the     filtering framework, which allows the execution of     arbitrary code.

  - CVE-2007-1887     Stefan Esser discovered that a buffer overflow in the     sqlite extension allows the execution of arbitrary code.

  - CVE-2007-1889     Stefan Esser discovered that the PHP memory manager     performs an incorrect type cast, which allows the     execution of arbitrary code through buffer overflows.

  - CVE-2007-1900     Stefan Esser discovered that incorrect validation in the     email filter extension allows the injection of mail     headers.

The oldstable distribution (sarge) doesn't include php5.

According to its banner, the version of PHP installed on the remote host is older than 5.2.1.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

According to its banner, the version of PHP installed on the remote host is older than 4.4.5.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

The remote host is running PHP less than 5.2.0.  This version is vulnerable to around 180 bugs.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	Name	Product	Family	Severity
29378	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3290)	Nessus	SuSE Local Security Checks	high
28053	Ubuntu 6.06 LTS / 6.10 / 7.04 : php5 vulnerabilities (USN-455-1)	Nessus	Ubuntu Local Security Checks	high
27150	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3289)	Nessus	SuSE Local Security Checks	high
25340	GLSA-200705-19 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25100	Debian DSA-1283-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
24907	PHP < 5.2.1 Multiple Vulnerabilities	Nessus	CGI abuses	high
24906	PHP < 4.4.5 Multiple Vulnerabilities	Nessus	CGI abuses	high
3857	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
801112	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2007-1700

critical

Tenable Plugins

high

high

high

high

high

high

high

medium

high