The chunk_split function in string.c in PHP 5.2.3 does not properly calculate the needed buffer size due to precision loss when performing integer arithmetic with floating point numbers, which has unknown attack vectors and impact, possibly resulting in a heap-based buffer overflow. NOTE: this is due to an incomplete fix for CVE-2007-2872.

This update fixes multiple bugs in php :

  - several problems in pcre (CVE-2007-1660, CVE-2006-7225,     CVE-2006-7224, CVE-2006-7226 CVE-2007-1659,     CVE-2006-7230)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars. (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php. (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php. (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php. (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php. (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception. (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php. (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow. (CVE-2007-4661,     CVE-2007-2872)

  - Flaws in the GD extension could lead to integer     overflows. (CVE-2007-3996)

  - The money_format function contained format string flaws.
    (CVE-2007-4658)

This update fixes multiple bugs in php by upgrading it to version 5.2.5.

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow (CVE-2007-4661,     CVE-2007-2872)

  - Flaws in the GD extension could lead to integer     overflows (CVE-2007-3996)

  - The money_format function contained format string flaws     (CVE-2007-4658)

  - Data for some time zones has been updated

  - php5 has been updated to version 5.2.5 to fix those     problems

This update fixes multiple bugs in php :

  - use system pcre library to fix several pcre     vulnerabilities (CVE-2007-1659, CVE-2006-7230,     CVE-2007-1660, CVE-2006-7227 CVE-2005-4872,     CVE-2006-7228)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow (CVE-2007-4661)

  - Flaws in the GD extension could lead to integer     overflows (CVE-2007-3996)

  - The money_format function contained format string flaws     (CVE-2007-4658)

  - Data for some time zones has been updated

This update fixes multiple bugs in php :

  - use system pcre library to fix several pcre     vulnerabilities. (CVE-2007-1659 / CVE-2006-7230 /     CVE-2007-1660 / CVE-2006-7227 / CVE-2005-4872 /     CVE-2006-7228)

  - Flaws in processing multi byte sequences in     htmlentities/htmlspecialchars. (CVE-2007-5898)

  - overly long arguments to the dl() function could crash     php. (CVE-2007-4825)

  - overy long arguments to the glob() function could crash     php. (CVE-2007-4782)

  - overly long arguments to some iconv functions could     crash php. (CVE-2007-4840)

  - overy long arguments to the setlocale() function could     crash php. (CVE-2007-4784)

  - the wordwrap-Function could cause a floating point     exception. (CVE-2007-3998)

  - overy long arguments to the fnmatch() function could     crash php. (CVE-2007-4782)

  - incorrect size calculation in the chunk_split function     could lead to a buffer overflow. (CVE-2007-4661)

  - Flaws in the GD extension could lead to integer     overflows. (CVE-2007-3996)

  - The money_format function contained format string flaws.
    (CVE-2007-4658)

  - Data for some time zones has been updated

USN-549-1 fixed vulnerabilities in PHP. However, some upstream changes were incomplete, which caused crashes in certain situations with Ubuntu 7.10. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that the wordwrap function did not correctly check lengths. Remote attackers could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service.
(CVE-2007-3998)

Integer overflows were discovered in the strspn and strcspn functions. Attackers could exploit this to read arbitrary areas of memory, possibly gaining access to sensitive information. (CVE-2007-4657)

Stanislav Malyshev discovered that money_format function did not correctly handle certain tokens. If a PHP application were tricked into processing a bad format string, a remote attacker could execute arbitrary code with application privileges. (CVE-2007-4658)

It was discovered that the php_openssl_make_REQ function did not correctly check buffer lengths. A remote attacker could send a specially crafted message and execute arbitrary code with application privileges. (CVE-2007-4662)

It was discovered that certain characters in session cookies were not handled correctly. A remote attacker could injection values which could lead to altered application behavior, potentially gaining additional privileges.
(CVE-2007-3799)

Gerhard Wagner discovered that the chunk_split function did not correctly handle long strings. A remote attacker could exploit this to execute arbitrary code with application privileges. (CVE-2007-2872, CVE-2007-4660, CVE-2007-4661)

Stefan Esser discovered that deeply nested arrays could be made to fill stack space. A remote attacker could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service. (CVE-2007-1285, CVE-2007-4670)

Rasmus Lerdorf discovered that the htmlentities and htmlspecialchars functions did not correctly stop when handling partial multibyte sequences. A remote attacker could exploit this to read certain areas of memory, possibly gaining access to sensitive information. (CVE-2007-5898)

It was discovered that the output_add_rewrite_var fucntion would sometimes leak session id information to forms targeting remote URLs. Malicious remote sites could use this information to gain access to a PHP application user's login credentials. (CVE-2007-5899).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the wordwrap function did not correctly check lengths. Remote attackers could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service.
(CVE-2007-3998)

Integer overflows were discovered in the strspn and strcspn functions.
Attackers could exploit this to read arbitrary areas of memory, possibly gaining access to sensitive information. (CVE-2007-4657)

Stanislav Malyshev discovered that money_format function did not correctly handle certain tokens. If a PHP application were tricked into processing a bad format string, a remote attacker could execute arbitrary code with application privileges. (CVE-2007-4658)

It was discovered that the php_openssl_make_REQ function did not correctly check buffer lengths. A remote attacker could send a specially crafted message and execute arbitrary code with application privileges. (CVE-2007-4662)

It was discovered that certain characters in session cookies were not handled correctly. A remote attacker could injection values which could lead to altered application behavior, potentially gaining additional privileges. (CVE-2007-3799)

Gerhard Wagner discovered that the chunk_split function did not correctly handle long strings. A remote attacker could exploit this to execute arbitrary code with application privileges. (CVE-2007-2872, CVE-2007-4660, CVE-2007-4661)

Stefan Esser discovered that deeply nested arrays could be made to fill stack space. A remote attacker could exploit this to cause a crash or monopolize CPU resources, resulting in a denial of service.
(CVE-2007-1285, CVE-2007-4670)

Rasmus Lerdorf discovered that the htmlentities and htmlspecialchars functions did not correctly stop when handling partial multibyte sequences. A remote attacker could exploit this to read certain areas of memory, possibly gaining access to sensitive information.
(CVE-2007-5898)

It was discovered that the output_add_rewrite_var fucntion would sometimes leak session id information to forms targeting remote URLs.
Malicious remote sites could use this information to gain access to a PHP application user's login credentials. (CVE-2007-5899).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-02 (PHP: Multiple vulnerabilities)

    Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip     Olausson reported integer overflows in the gdImageCreate() and     gdImageCreateTrueColor() functions of the GD library which can cause     heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered     an integer overflow in the chunk_split() function that can lead to a     heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused     incorrect buffer size calculation due to precision loss, also resulting     in a possible heap-based buffer overflow (CVE-2007-4661 and     CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the     SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1     was not fixed correctly (CVE-2007-1887).
    Stefan Esser discovered an error in the zend_alter_ini_entry() function     handling a memory_limit violation (CVE-2007-4659). Stefan Esser also     discovered a flaw when handling interruptions with userspace error     handlers that can be exploited to read arbitrary heap memory     (CVE-2007-1883). Disclosure of sensitive memory can also be triggered     due to insufficient boundary checks in the strspn() and strcspn()     functions, an issue discovered by Mattias Bengtsson and Philip Olausson     (CVE-2007-4657)     Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL     filter of the Filter extension allowing arbitrary email header     injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed     in GLSA 200705-19.
    Stanislav Malyshev found an error with unknown impact in the     money_format() function when processing '%i' and '%n' tokens     (CVE-2007-4658). zatanzlatan reported a buffer overflow in the     php_openssl_make_REQ() function with unknown impact when providing a     manipulated SSL configuration file (CVE-2007-4662). Possible memory     corruption when trying to read EXIF data in exif_read_data() and     exif_thumbnail() occurred with unknown impact.
    Several vulnerabilities that allow bypassing of open_basedir and other     restrictions were reported, including the glob() function     (CVE-2007-4663), the session_save_path(), ini_set(), and error_log()     functions which can allow local command execution (CVE-2007-3378),     involving the readfile() function (CVE-2007-3007), via the Session     extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and     in the dl() function which allows loading extensions outside of the     specified directory (CVE-2007-4825).
    Multiple Denial of Service vulnerabilities were discovered, including a     long 'library' parameter in the dl() function (CVE-2007-4887), in     several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783),     in the setlocale() function (CVE-2007-4784), in the glob() and     fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point     exception in the wordwrap() function (CVE-2007-3998), a stack     exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop     caused by a specially crafted PNG image in the png_read_info() function     of libpng (CVE-2007-2756) and several issues related to array     conversion.
  Impact :

    Remote attackers might be able to exploit these issues in PHP     applications making use of the affected functions, potentially     resulting in the execution of arbitrary code, Denial of Service,     execution of scripted contents in the context of the affected site,     security bypass or information leak.
  Workaround :

    There is no known workaround at this time.

The PHP development team reports :

Security Enhancements and Fixes in PHP 5.2.4 :

- Fixed a floating point exception inside wordwrap() (Reported by Mattias Bengtsson)

- Fixed several integer overflows inside the GD extension (Reported by Mattias Bengtsson)

- Fixed size calculation in chunk_split() (Reported by Gerhard Wagner)

- Fixed integer overflow in str[c]spn(). (Reported by Mattias Bengtsson)

- Fixed money_format() not to accept multiple %i or %n tokens.
(Reported by Stanislav Malyshev)

- Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Reported by Stefan Esser)

- Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Reported by Mattias Bengtsson)

- Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian Arciemowicz)

- Fixed a possible invalid read in glob() win32 implementation (CVE-2007-3806) (Reported by shinnai)

- Fixed a possible buffer overflow in php_openssl_make_REQ (Reported by zatanzlatan at hotbrev dot com)

- Fixed an open_basedir bypass inside glob() function (Reported by dr at peytz dot dk)

- Fixed a possible open_basedir bypass inside session extension when the session file is a symlink (Reported by c dot i dot morris at durham dot ac dot uk)

- Improved fix for MOPB-03-2007.

- Corrected fix for CVE-2007-2872.

According to its banner, the version of PHP installed on the remote host is older than 5.2.4.  Such versions may be affected by various issues, including but not limited to several overflows.

ID	Name	Product	Family	Severity
41187	SuSE9 Security Update : PHP4 (YOU Patch Number 12049)	Nessus	SuSE Local Security Checks	high
30092	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-4909)	Nessus	SuSE Local Security Checks	high
29878	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-4810)	Nessus	SuSE Local Security Checks	high
29780	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 4808)	Nessus	SuSE Local Security Checks	high
29213	Ubuntu 7.10 : php5 regression (USN-549-2)	Nessus	Ubuntu Local Security Checks	high
28372	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : php5 vulnerabilities (USN-549-1)	Nessus	Ubuntu Local Security Checks	high
26942	GLSA-200710-02 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
26038	FreeBSD : php -- multiple vulnerabilities (71d903fc-602d-11dc-898c-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	high
25971	PHP < 5.2.4 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2007-4661

critical

Tenable Plugins

high

high

high

high

high

high

high

high

medium