The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0040 advisory.

    - add security fix for CVE-2009-4142 (#543469)
    - add security fixes for CVE-2009-2687, CVE-2009-3291, CVE-2009-3292,       CVE-2009-3546 CVE-2009-4017 (#541597)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2009-2687 php: exif_read_data crash on corrupted JPEG files

CVE-2009-3292 php: exif extension: Multiple missing sanity checks in EXIF file processing

CVE-2009-3291 php: openssl extension: Incorrect verification of SSL certificate with NUL in name

CVE-2009-3546 gd: insufficient input validation in _gdGetColors()

CVE-2009-4017 PHP: resource exhaustion attack via upload requests with lots of files

CVE-2009-4142 php: htmlspecialchars() insufficient checking of input for multi-byte encodings

Multiple missing input sanitization flaws were discovered in PHP's exif extension. A specially crafted image file could cause the PHP interpreter to crash or, possibly, disclose portions of its memory when a PHP script tried to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2009-2687, CVE-2009-3292)

A missing input sanitization flaw, leading to a buffer overflow, was discovered in PHP's gd library. A specially crafted GD image file could cause the PHP interpreter to crash or, possibly, execute arbitrary code when opened. (CVE-2009-3546)

It was discovered that PHP did not limit the maximum number of files that can be uploaded in one request. A remote attacker could use this flaw to instigate a denial of service by causing the PHP interpreter to use lots of system resources dealing with requests containing large amounts of files to be uploaded. This vulnerability depends on file uploads being enabled (which it is, in the default PHP configuration).
(CVE-2009-4017)

Note: This update introduces a new configuration option, max_file_uploads, used for limiting the number of files that can be uploaded in one request. By default, the limit is 20 files per request.

It was discovered that PHP was affected by the previously published 'null prefix attack', caused by incorrect handling of NUL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse PHP into accepting it by mistake. (CVE-2009-3291)

It was discovered that PHP's htmlspecialchars() function did not properly recognize partial multi-byte sequences for some multi-byte encodings, sending them to output without them being escaped. An attacker could use this flaw to perform a cross-site scripting attack.
(CVE-2009-4142)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

This update of PHP5 fixes :

  - CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges,     and Access Control (CWE-264) CVE-2008-5814: CVSS v2 Base     Score: 2.6 (LOW) (AV:N/AC:H/Au:N/C:N/I:P/A:N):
    Cross-Site Scripting (XSS) (CWE-79) CVE-2009-2626: CVSS     v2 Base Score: 6.4 (MEDIUM)     (AV:N/AC:L/Au:N/C:P/I:N/A:P): Other (CWE-Other)     CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Input Validation (CWE-20)     CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate)     (AV:L/AC:M/Au:N/C:P/I:P/A:P): Other (CWE-Other)     CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate)     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Other (CWE-Other)     CVE-2009-4142: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting     (XSS). (CWE-79). (CVE-2008-5624: CVSS v2 Base Score: 7.5     (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions,     Privileges, and Access Control (CWE-264))

A vulnerability has been found and corrected in php :

The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character (CVE-2009-4142).

The updated packages have been patched to correct this issue.

Update to the latest PHP 5.2 release which focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release. See http://www.php.net/releases/5_2_12.php for more details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

The remote host is affected by the vulnerability described in GLSA-201001-03 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the     CVE identifiers referenced below and the associated PHP release notes     for details.
  Impact :

    A context-dependent attacker could execute arbitrary code via a     specially crafted string containing an HTML entity when the mbstring     extension is enabled. Furthermore a remote attacker could execute     arbitrary code via a specially crafted GD graphics file.
    A remote attacker could also cause a Denial of Service via a malformed     string passed to the json_decode() function, via a specially crafted     ZIP file passed to the php_zip_make_relative_path() function, via a     malformed JPEG image passed to the exif_read_data() function, or via     temporary file exhaustion. It is also possible for an attacker to spoof     certificates, bypass various safe_mode and open_basedir restrictions     when certain criteria are met, perform Cross-site scripting attacks,     more easily perform SQL injection attacks, manipulate settings of other     virtual hosts on the same server via a malicious .htaccess entry when     running on Apache, disclose memory portions, and write arbitrary files     via a specially crafted ZIP archive. Some vulnerabilities with unknown     impact and attack vectors have been reported as well.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in PHP 5, an hypertext preprocessor. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4142     The htmlspecialchars function does not properly handle     invalid multi-byte sequences.

  - CVE-2009-4143     Memory corruption via session interruption.

In the stable distribution (lenny), this update also includes bug fixes (bug #529278, #556459, #565387, #523073) that were to be included in a stable point release as version 5.2.6.dfsg.1-1+lenny5.

This update of PHP5 fixes :

  - CVE-2008-5624: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P) : Permissions, Privileges,     and Access Control (CWE-264)

  - CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P) : Permissions, Privileges,     and Access Control (CWE-264)

  - Cross-Site Scripting (XSS). (CWE-79). (CVE-2008-5814:
    CVSS v2 Base Score: 2.6 (LOW)     (AV:N/AC:H/Au:N/C:N/I:P/A:N))

  - CVE-2009-2626: CVSS v2 Base Score: 6.4 (MEDIUM)     (AV:N/AC:L/Au:N/C:P/I:N/A:P) : Other (CWE-Other)

  - CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:N/A:P) : Input Validation (CWE-20)

  - CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate)     (AV:L/AC:M/Au:N/C:P/I:P/A:P) : Other (CWE-Other)

  - CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate)     (AV:N/AC:L/Au:N/C:N/I:N/A:P) : Other (CWE-Other)

  - Cross-Site Scripting (XSS) (CWE-79). (CVE-2009-4142:
    CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N))

This update of php5 fixes: CVE-2008-5624: CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges, and Access Control (CWE-264) CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges, and Access Control (CWE-264) CVE-2008-5814: CVSS v2 Base Score: 2.6 (LOW) (AV:N/AC:H/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79) CVE-2009-2626: CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:N/A:P): Other (CWE-Other) CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:N/A:P): Input Validation (CWE-20) CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate) (AV:L/AC:M/Au:N/C:P/I:P/A:P): Other (CWE-Other) CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Other (CWE-Other) CVE-2009-4142: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79)

New php packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.

Multiple vulnerabilities has been found and corrected in php :

The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable (CVE-2009-2626).

The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character (CVE-2009-4142).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct these issues.

Maksymilian Arciemowicz discovered that PHP did not properly handle the ini_restore function. An attacker could exploit this issue to obtain random memory contents or to cause the PHP server to crash, resulting in a denial of service. (CVE-2009-2626)

It was discovered that the htmlspecialchars function did not properly handle certain character sequences, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain.
(CVE-2009-4142)

Stefan Esser discovered that PHP did not properly handle session data.
An attacker could exploit this issue to bypass safe_mode or open_basedir restrictions. (CVE-2009-4143).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0040 advisory.

  - php: exif_read_data crash on corrupted JPEG files (CVE-2009-2687)

  - php: openssl extension: Incorrect verification of SSL certificate with NUL in name (CVE-2009-3291)

  - php: exif extension: Multiple missing sanity checks in EXIF file processing (CVE-2009-3292)

  - gd: insufficient input validation in _gdGetColors() (CVE-2009-3546)

  - PHP: resource exhaustion attack via upload requests with lots of files (CVE-2009-4017)

  - php: htmlspecialchars() insufficient checking of input for multi-byte encodings (CVE-2009-4142)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

Multiple missing input sanitization flaws were discovered in PHP's exif extension. A specially crafted image file could cause the PHP interpreter to crash or, possibly, disclose portions of its memory when a PHP script tried to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2009-2687, CVE-2009-3292)

A missing input sanitization flaw, leading to a buffer overflow, was discovered in PHP's gd library. A specially crafted GD image file could cause the PHP interpreter to crash or, possibly, execute arbitrary code when opened. (CVE-2009-3546)

It was discovered that PHP did not limit the maximum number of files that can be uploaded in one request. A remote attacker could use this flaw to instigate a denial of service by causing the PHP interpreter to use lots of system resources dealing with requests containing large amounts of files to be uploaded. This vulnerability depends on file uploads being enabled (which it is, in the default PHP configuration).
(CVE-2009-4017)

Note: This update introduces a new configuration option, max_file_uploads, used for limiting the number of files that can be uploaded in one request. By default, the limit is 20 files per request.

It was discovered that PHP was affected by the previously published 'null prefix attack', caused by incorrect handling of NUL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse PHP into accepting it by mistake. (CVE-2009-3291)

It was discovered that PHP's htmlspecialchars() function did not properly recognize partial multi-byte sequences for some multi-byte encodings, sending them to output without them being escaped. An attacker could use this flaw to perform a cross-site scripting attack.
(CVE-2009-4142)

All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

According to its banner, the version of PHP 5.2.x installed on the remote host is earlier than 5.2.12.  Such versions are potentially affected by multiple vulnerabilities : 

  - A safe_mode bypass in tempnam(). (CVE-2009-3557)

  - An open_basedir bypass in posix_mkfifo(). (CVE-2009-3558)

  - A possible denial-of-service via temporary file exhaustion caused by a failure to limit the number of file uploads per request. (CVE-2009-4017)

  - An arbitrary code execution vulnerability in the 'session.save_path()' function and the '$_SESSION' data structure. (CVE-2009-4143)

  - A cross-site scripting vulnerability becuase the 'htmlspecialcharacters()' function fails to properly handle some malformed multibyte character sequences.

According to its banner, the version of PHP installed on the remote host is older than 5.2.12.  Such versions may be affected by several security issues :

  - It is possible to bypass the 'safe_mode' configuration     setting using 'tempnam()'. (CVE-2009-3557)

  - It is possible to bypass the 'open_basedir'     configuration setting using 'posix_mkfifo()'.     (CVE-2009-3558)

  - Provided file uploading is enabled (it is by default),     an attacker can upload files using a POST request with     'multipart/form-data' content even if the target script     doesn't actually support file uploads per se.  By     supplying a large number (15,000+) of files, an attacker     could cause the web server to stop responding while it     processes the file list. (CVE-2009-4017)

  - Missing protection for '$_SESSION' from interrupt     corruption and improved 'session.save_path' check.
    (CVE-2009-4143)

  - Insufficient input string validation in the     'htmlspecialchars()' function. (CVE-2009-4142)

PHP developers reports :

This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.12 :

- Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)

- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)

- Added 'max_file_uploads' INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion, identified by Bogdan Calin. (CVE-2009-4017, Ilia)

- Added protection for $_SESSION from interrupt corruption and improved 'session.save_path' check, identified by Stefan Esser.
(CVE-2009-4143, Stas)

- Fixed bug #49785 (insufficient input string validation of htmlspecialchars()). (CVE-2009-4142, Moriyoshi, hello at iwamot dot com)

ID	Name	Product	Family	Severity
67986	Oracle Linux 5 : php (ELSA-2010-0040)	Nessus	Oracle Linux Local Security Checks	medium
60723	Scientific Linux Security Update : php on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
49829	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6847)	Nessus	SuSE Local Security Checks	high
48165	Mandriva Linux Security Advisory : php (MDVSA-2010:009)	Nessus	Mandriva Local Security Checks	medium
47186	Fedora 11 : maniadrive-1.2-17.fc11 / php-5.2.12-1.fc11 (2010-0495)	Nessus	Fedora Local Security Checks	high
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
44892	GLSA-201001-03 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
44865	Debian DSA-2001-1 : php5 - multiple vulnerabilities	Nessus	Debian Local Security Checks	critical
44687	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6846)	Nessus	SuSE Local Security Checks	high
44686	SuSE 11 Security Update : PHP5 (SAT Patch Number 1978)	Nessus	SuSE Local Security Checks	high
44683	openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)	Nessus	SuSE Local Security Checks	high
44680	openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)	Nessus	SuSE Local Security Checks	high
44678	openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)	Nessus	SuSE Local Security Checks	high
44121	Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / current : php (SSA:2010-024-02)	Nessus	Slackware Local Security Checks	critical
44041	Mandriva Linux Security Advisory : php (MDVSA-2010:008)	Nessus	Mandriva Local Security Checks	medium
43897	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : php5 vulnerabilities (USN-882-1)	Nessus	Ubuntu Local Security Checks	critical
43883	RHEL 4 / 5 : php (RHSA-2010:0040)	Nessus	Red Hat Local Security Checks	medium
43878	CentOS 3 / 4 / 5 : php (CESA-2010:0040)	Nessus	CentOS Local Security Checks	high
801091	PHP 5.2.x < 5.2.12 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium
5281	PHP 5.2.x < 5.2.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
43351	PHP < 5.2.12 Multiple Vulnerabilities	Nessus	CGI abuses	medium
43342	FreeBSD : php -- multiple vulnerabilities (39a25a63-eb5c-11de-b650-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2009-4142

medium

Tenable Plugins

medium

high

high

medium

high

critical

critical

critical

high

high

high

high

high

critical

medium

critical

medium

high

medium

medium

medium

critical