Double free vulnerability in the unserializer in PHP 4.4.5 and 4.4.6 allows context-dependent attackers to execute arbitrary code by overwriting variables pointing to (1) the GLOBALS array or (2) the session data in _SESSION. NOTE: this issue was introduced when attempting to patch CVE-2007-1701 (MOPB-31-2007).

The remote BIG-IP device is missing a patch required by a security advisory.

From Red Hat Security Advisory 2007:0155 :

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A denial of service flaw was found in the way PHP processed a deeply nested array. A remote attacker could cause the PHP interpreter to crash by submitting an input variable with a deeply nested array.
(CVE-2007-1285)

A flaw was found in the way PHP's unserialize() function processed data. If a remote attacker was able to pass arbitrary data to PHP's unserialize() function, they could possibly execute arbitrary code as the apache user. (CVE-2007-1286)

A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection.
(CVE-2007-1583)

A double free flaw was found in PHP's session_decode() function. If a remote attacker was able to pass arbitrary data to PHP's session_decode() function, they could possibly execute arbitrary code as the apache user. (CVE-2007-1711)

A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718)

A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution.
(CVE-2007-1001)

A buffer over-read flaw was discovered in PHP's gd extension. A script that could be forced to write arbitrary string using a JIS font from an untrusted source could cause the PHP interpreter to crash.
(CVE-2007-0455)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

The remote host is affected by the vulnerability described in GLSA-200705-19 (PHP: Multiple vulnerabilities)

    Several vulnerabilities were found in PHP, most of them during the     Month Of PHP Bugs (MOPB) by Stefan Esser. The most severe of these     vulnerabilities are integer overflows in wbmp.c from the GD library     (CVE-2007-1001) and in the substr_compare() PHP 5 function     (CVE-2007-1375). Ilia Alshanetsky also reported a buffer overflow in     the make_http_soap_request() and in the user_filter_factory_create()     functions (CVE-2007-2510, CVE-2007-2511), and Stanislav Malyshev     discovered another buffer overflow in the bundled XMLRPC library     (CVE-2007-1864). Additionally, the session_regenerate_id() and the     array_user_key_compare() functions contain a double-free vulnerability     (CVE-2007-1484, CVE-2007-1521). Finally, there exist implementation     errors in the Zend engine, in the mb_parse_str(), the unserialize() and     the mail() functions and other elements.
  Impact :

    Remote attackers might be able to exploit these issues in PHP     applications making use of the affected functions, potentially     resulting in the execution of arbitrary code, Denial of Service,     execution of scripted contents in the context of the affected site,     security bypass or information leak.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1286     Stefan Esser discovered an overflow in the object     reference handling code of the unserialize() function,     which allows the execution of arbitrary code if     malformed input is passed from an application.

  - CVE-2007-1375     Stefan Esser discovered that an integer overflow in the     substr_compare() function allows information disclosure     of heap memory.

  - CVE-2007-1376     Stefan Esser discovered that insufficient validation of     shared memory functions allows the disclosure of heap     memory.

  - CVE-2007-1380     Stefan Esser discovered that the session handler     performs insufficient validation of variable name length     values, which allows information disclosure through a     heap information leak.

  - CVE-2007-1453     Stefan Esser discovered that the filtering framework     performs insufficient input validation, which allows the     execution of arbitrary code through a buffer underflow.

  - CVE-2007-1454     Stefan Esser discovered that the filtering framework can     be bypassed with a special whitespace character.

  - CVE-2007-1521     Stefan Esser discovered a double free vulnerability in     the session_regenerate_id() function, which allows the     execution of arbitrary code.

  - CVE-2007-1583     Stefan Esser discovered that a programming error in the     mb_parse_str() function allows the activation of     'register_globals'.

  - CVE-2007-1700     Stefan Esser discovered that the session extension     incorrectly maintains the reference count of session     variables, which allows the execution of arbitrary code.

  - CVE-2007-1711     Stefan Esser discovered a double free vulnerability in     the session management code, which allows the execution     of arbitrary code.

  - CVE-2007-1718     Stefan Esser discovered that the mail() function     performs insufficient validation of folded mail headers,     which allows mail header injection.

  - CVE-2007-1777     Stefan Esser discovered that the extension to handle ZIP     archives performs insufficient length checks, which     allows the execution of arbitrary code.

  - CVE-2007-1824     Stefan Esser discovered an off-by-one error in the     filtering framework, which allows the execution of     arbitrary code.

  - CVE-2007-1887     Stefan Esser discovered that a buffer overflow in the     sqlite extension allows the execution of arbitrary code.

  - CVE-2007-1889     Stefan Esser discovered that the PHP memory manager     performs an incorrect type cast, which allows the     execution of arbitrary code through buffer overflows.

  - CVE-2007-1900     Stefan Esser discovered that incorrect validation in the     email filter extension allows the injection of mail     headers.

The oldstable distribution (sarge) doesn't include php5.

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1286     Stefan Esser discovered an overflow in the object     reference handling code of the unserialize() function,     which allows the execution of arbitrary code if     malformed input is passed from an application.

  - CVE-2007-1380     Stefan Esser discovered that the session handler     performs insufficient validation of variable name length     values, which allows information disclosure through a     heap information leak.

  - CVE-2007-1521     Stefan Esser discovered a double free vulnerability in     the session_regenerate_id() function, which allows the     execution of arbitrary code.

  - CVE-2007-1711     Stefan Esser discovered a double free vulnerability in     the session management code, which allows the execution     of arbitrary code.

  - CVE-2007-1718     Stefan Esser discovered that the mail() function     performs insufficient validation of folded mail headers,     which allows mail header injection.

  - CVE-2007-1777     Stefan Esser discovered that the extension to handle ZIP     archives performs insufficient length checks, which     allows the execution of arbitrary code.

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A denial of service flaw was found in the way PHP processed a deeply nested array. A remote attacker could cause the PHP interpreter to crash by submitting an input variable with a deeply nested array.
(CVE-2007-1285)

A flaw was found in the way PHP's unserialize() function processed data. If a remote attacker was able to pass arbitrary data to PHP's unserialize() function, they could possibly execute arbitrary code as the apache user. (CVE-2007-1286)

A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection.
(CVE-2007-1583)

A double free flaw was found in PHP's session_decode() function. If a remote attacker was able to pass arbitrary data to PHP's session_decode() function, they could possibly execute arbitrary code as the apache user. (CVE-2007-1711)

A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718)

A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution.
(CVE-2007-1001)

A buffer over-read flaw was discovered in PHP's gd extension. A script that could be forced to write arbitrary string using a JIS font from an untrusted source could cause the PHP interpreter to crash.
(CVE-2007-0455)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A denial of service flaw was found in the way PHP processed a deeply nested array. A remote attacker could cause the PHP interpreter to crash by submitting an input variable with a deeply nested array.
(CVE-2007-1285)

A flaw was found in the way PHP's unserialize() function processes data. If a remote attacker is able to pass arbitrary data to PHP's unserialize() function, it may be possible for them to execute arbitrary code as the apache user. (CVE-2007-1286)

A double free flaw was found in PHP's session_decode() function. If a remote attacker is able to pass arbitrary data to PHP's session_decode() function, it may be possible for them to execute arbitrary code as the apache user. (CVE-2007-1711)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.

ID	Name	Product	Family	Severity
78215	F5 Networks BIG-IP : Multiple PHP vulnerabilities (SOL7859)	Nessus	F5 Networks Local Security Checks	high
67471	Oracle Linux 3 / 4 : php (ELSA-2007-0155)	Nessus	Oracle Linux Local Security Checks	high
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical
25340	GLSA-200705-19 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25100	Debian DSA-1283-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
25099	Debian DSA-1282-1 : php4 - several vulnerabilities	Nessus	Debian Local Security Checks	high
25068	RHEL 3 / 4 : php (RHSA-2007:0155)	Nessus	Red Hat Local Security Checks	high
25067	RHEL 2.1 : php (RHSA-2007:0154)	Nessus	Red Hat Local Security Checks	medium
25043	CentOS 3 / 4 : php (CESA-2007:0155)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2007-1711

critical

Tenable Plugins

high

high

critical

high

high

high

high

medium

high