PHP 5 before 5.2.3 does not enforce the open_basedir or safe_mode restriction in certain cases, which allows context-dependent attackers to determine the existence of arbitrary files by checking if the readfile function returns a string. NOTE: this issue might also involve the realpath function.

The following issues have been fixed :

  - missing open_basedir and safe_mode restriction.
    (CVE-2007-3007)

  - chunk_split() integer overflow. (CVE-2007-2872)

  - DoS condition in libgd's image processing.
    (CVE-2007-2756)

  - possible super-global overwrite inside     import_request_variables(). (CVE-2007-1396)

  - buffer overflow inside user_filter_factory_create().
    (CVE-2007-2511)

  - remotely trigger-able buffer overflow inside bundled     libxmlrpc. (CVE-2007-1864)

  - CRLF injection inside ftp_putcmd(). (CVE-2007-2509)

  - remotely trigger-able buffer overflow inside     make_http_soap_request(). (CVE-2007-2510)

  - MOPB-41-2007:PHP 5 sqlite_udf_decode_binary() Buffer     Overflow Vulnerability. (CVE-2007-0906)

  - MOPB-03-2007: deep recursion DoS (CVE-2007-1285)

This update includes the latest release of PHP 5.2.

A number of security issues have been fixed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following issues have been fixed in PHP, which were spotted by the MOPB project or fixed in PHP 5.2.3 release :

  - missing open_basedir and safe_mode restriction     (CVE-2007-3007)

  - chunk_split() integer overflow (CVE-2007-2872)

  - DoS condition in libgd's image processing     (CVE-2007-2756)

  - possible super-global overwrite inside     import_request_variables() (CVE-2007-1396)

  - buffer overflow inside user_filter_factory_create()     (CVE-2007-2511)

  - remotely trigger-able buffer overflow inside bundled     libxmlrpc (CVE-2007-1864)

  - CRLF injection inside ftp_putcmd() (CVE-2007-2509)

  - remotely trigger-able buffer overflow inside     make_http_soap_request() (CVE-2007-2510)

  - MOPB-41-2007:PHP 5 sqlite_udf_decode_binary() Buffer     Overflow Vulnerability (CVE-2007-0906)

  - MOPB-03-2007: deep recursion DoS (CVE-2007-1285)

The remote host is affected by the vulnerability described in GLSA-200710-02 (PHP: Multiple vulnerabilities)

    Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip     Olausson reported integer overflows in the gdImageCreate() and     gdImageCreateTrueColor() functions of the GD library which can cause     heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered     an integer overflow in the chunk_split() function that can lead to a     heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused     incorrect buffer size calculation due to precision loss, also resulting     in a possible heap-based buffer overflow (CVE-2007-4661 and     CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the     SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1     was not fixed correctly (CVE-2007-1887).
    Stefan Esser discovered an error in the zend_alter_ini_entry() function     handling a memory_limit violation (CVE-2007-4659). Stefan Esser also     discovered a flaw when handling interruptions with userspace error     handlers that can be exploited to read arbitrary heap memory     (CVE-2007-1883). Disclosure of sensitive memory can also be triggered     due to insufficient boundary checks in the strspn() and strcspn()     functions, an issue discovered by Mattias Bengtsson and Philip Olausson     (CVE-2007-4657)     Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL     filter of the Filter extension allowing arbitrary email header     injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed     in GLSA 200705-19.
    Stanislav Malyshev found an error with unknown impact in the     money_format() function when processing '%i' and '%n' tokens     (CVE-2007-4658). zatanzlatan reported a buffer overflow in the     php_openssl_make_REQ() function with unknown impact when providing a     manipulated SSL configuration file (CVE-2007-4662). Possible memory     corruption when trying to read EXIF data in exif_read_data() and     exif_thumbnail() occurred with unknown impact.
    Several vulnerabilities that allow bypassing of open_basedir and other     restrictions were reported, including the glob() function     (CVE-2007-4663), the session_save_path(), ini_set(), and error_log()     functions which can allow local command execution (CVE-2007-3378),     involving the readfile() function (CVE-2007-3007), via the Session     extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and     in the dl() function which allows loading extensions outside of the     specified directory (CVE-2007-4825).
    Multiple Denial of Service vulnerabilities were discovered, including a     long 'library' parameter in the dl() function (CVE-2007-4887), in     several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783),     in the setlocale() function (CVE-2007-4784), in the glob() and     fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point     exception in the wordwrap() function (CVE-2007-3998), a stack     exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop     caused by a specially crafted PNG image in the png_read_info() function     of libpng (CVE-2007-2756) and several issues related to array     conversion.
  Impact :

    Remote attackers might be able to exploit these issues in PHP     applications making use of the affected functions, potentially     resulting in the execution of arbitrary code, Denial of Service,     execution of scripted contents in the context of the affected site,     security bypass or information leak.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.3.  Such versions may be affected by several issues including an integer overflow, 'safe_mode' and 'open_basedir' bypass, and a denial of service vulnerability.

According to its banner, the version of PHP installed on the remote host is older than 5.2.3. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow in the sqlite_decode_function() in     the bundled sqlite library could allow context-dependent     attackers to execute arbitrary code. (CVE-2007-1887)

  - A CRLF injection vulnerability in the     FILTER_VALIDATE_EMAIL filter could allow an attacker to     inject arbitrary email headers via a special email     address. This only affects Mandriva Linux 2007.1.
    (CVE-2007-1900)

  - An infinite-loop flaw was discovered in the PHP gd     extension. A script that could be forced to process PNG     images from an untrusted source could allow a remote     attacker to cause a denial of service. (CVE-2007-2756)

  - An integer overflow flaw was found in the     chunk_split() function that ould possibly execute     arbitrary code as the apache user if a remote attacker     was able to pass arbitrary data to the third argument of     chunk_split() (CVE-2007-2872).

  - An open_basedir and safe_mode restriction bypass which     could allow context-dependent attackers to determine the     existence of arbitrary files. (CVE-2007-3007)

According to its banner, the version of PHP installed on the remote host is older than 5.2.3.  Such versions may be affected by several issues including an integer overflow, 'safe_mode' and 'open_basedir' bypass, and a denial of service vulnerability.

ID	Name	Product	Family	Severity
29552	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3754)	Nessus	SuSE Local Security Checks	high
27759	Fedora 7 : php-5.2.4-1.fc7 (2007-2215)	Nessus	Fedora Local Security Checks	high
27392	openSUSE 10 Security Update : php5 (php5-3753)	Nessus	SuSE Local Security Checks	high
27391	openSUSE 10 Security Update : php5 (php5-3745)	Nessus	SuSE Local Security Checks	high
26942	GLSA-200710-02 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
4074	PHP 5.x < 5.2.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
25368	PHP < 5.2.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
801114	PHP < 5.2.3 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2007-3007

medium

Tenable Plugins

high

high

high

high

high

medium

high

medium