sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

when used in CGI mode remote attackers could inject command line arguments to php

The PHP installation on the remote web server contains a flaw that could allow a remote attacker to pass command-line arguments as part of a query string to the PHP-CGI program.  This could be abused to execute arbitrary code, reveal PHP source code, cause a system crash, etc.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is a version prior to 7.2.1.0. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability, known as BEAST,     exists in the SSL 3.0 and TLS 1.0 protocols due to a     flaw in the way the initialization vector (IV) is     selected when operating in cipher-block chaining (CBC)     modes. A man-in-the-middle attacker can exploit this     to obtain plaintext HTTP header data, by using a     blockwise chosen-boundary attack (BCBA) on an HTTPS     session, in conjunction with JavaScript code that uses     the HTML5 WebSocket API, the Java URLConnection API,     or the Silverlight WebClient API. (CVE-2011-3389)

  - The utility 'apachectl' can receive a zero-length     directory name in the LD_LIBRARY_PATH via the 'envvars'     file. A local attacker with access to that utility     could exploit this to load a malicious Dynamic Shared     Object (DSO), leading to arbitrary code execution.
    (CVE-2012-0883)

  - Numerous, unspecified errors could allow remote denial     of service attacks. (CVE-2012-2110, CVE-2012-2329,     CVE-2012-2336, CVE-2013-2357, CVE-2013-2358,     CVE-2013-2359, CVE-2013-2360)

  - The fix for CVE-2012-1823 does not completely correct     the CGI query parameter vulnerability. Disclosure of     PHP source code and code execution are still possible.
    Note that this vulnerability is exploitable only when     PHP is used in CGI-based configurations.  Apache with     'mod_php' is not an exploitable configuration.
    (CVE-2012-2311, CVE-2012-2335)

  - Unspecified errors exist that could allow unauthorized     access. (CVE-2012-5217, CVE-2013-2355)

  - Unspecified errors exist that could allow disclosure of     sensitive information. (CVE-2013-2356, CVE-2013-2363)

  - An unspecified error exists that could allow cross-site     scripting attacks. (CVE-2013-2361)

  - Unspecified errors exist that could allow a local     attacker to cause denial of service conditions.
    (CVE-2013-2362, CVE-2013-2364)

  - An as-yet unspecified vulnerability exists that could     cause a denial of service condition. (CVE-2013-4821)

This update fixes several security issues in PHP5 :

  - A directory traversal bug has been fixed in PHP5.
    (CVE-2012-1172)

  - A command injection was possible when PHP5 was operated     in CGI mode using commandline options. This problem does     not affect PHP5 in the normal Apache module mode setup.
    (CVE-2012-1823 / CVE-2012-2311)

This update fixes several security issues in PHP5 :

  - A directory traversal bug has been fixed in PHP5.
    (CVE-2012-1172)

  - A command injection was possible when PHP5 was operated     in CGI mode using commandline options. This problem does     not affect PHP5 in the normal apache module mode setup.
    (CVE-2012-1823 / CVE-2012-2311)

  - Also a pack/unpacking bug on big endian 64bit     architectures (ppc64 and s390x) has been fixed.
    (bnc#753778)

The remote host is affected by the vulnerability described in GLSA-201209-03 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code with the privileges of       the process, cause a Denial of Service condition, obtain sensitive       information, create arbitrary files, conduct directory traversal attacks,       bypass protection mechanisms, or perform further attacks with unspecified       impact.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.8 that is older than version 10.8.2.  The newer version contains numerous security-related fixes for the following components :

  - BIND

  - Data Security

  - LoginWindow
\  - Mobile Accounts

  - PHP



The remote host is running a version of Mac OS X 10.7 that is older than version 10.7.5.  The newer version contains numerous security-related fixes for the following components :

  - Apache

  - BIND

  - CoreText

  - Data Security

  - ImageIO

  - Installer

  - International Components for Unicode

  - Kernel

  - Mail

  - PHP

  - Profile Manager

  - QuickLook

  - QuickTime

  - Ruby

  - USB

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.2. The newer version contains multiple security-related fixes for the following components :

  - BIND
  - Data Security
  - LoginWindow
  - Mobile Accounts
  - PHP

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - BIND
  - CoreText
  - Data Security
  - ImageIO
  - Installer
  - International Components for Unicode
  - Kernel
  - Mail
  - PHP
  - Profile Manager
  - QuickLook
  - QuickTime
  - Ruby
  - USB

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-004 applied. This update contains multiple security-related fixes for the following components :

  - Apache
  - Data Security
  - DirectoryService
  - ImageIO
  - International Components for Unicode
  - Mail
  - PHP
  - QuickLook
  - QuickTime
  - Ruby

PHP versions earlier than 5.3.13 are affected by a code execution vulnerability.

 The fix for CVE-2012-1823 does not completely correct the CGI query vulnerability. Disclosure of PHP source code and code execution via query paramenters are still possible.

Note that his vulnerability is exploitable only when PHP is used by CGI-based configurations. Apache with  'mod-php' is not an exploitable configuration.

PHP versions earlier than 5.4.3 are affected by the following vulnerabilities.

  - The fix for CVE-2012-1823 does not completely correct the CGI query parameter vulnerability. Disclosure of PHP source code and code execution via query paramenters are still possible. Note that his vulnerability is exploitable only when PHP is used by CGI-based configurations. Apache with 'mod-php' is not an exploitable configuration. (CVE-2012-2311, CVE-2012-2335, CVE-2012-2336)

  - An unspecified buffer overflow exists related to the function 'apache_request_headers'. (CVE-2012-2329)

Versions of PHP 5.4.x prior to 5.4.3 are affected by the following vulnerabilities :

 - The fix for CVE-2012-1823 does not completely correct the CGI query parameter vulnerability. Disclosure of PHP source code and code execution via query paramenters are still possible. Note that his vulnerability is exploitable only when PHP is used by CGI-based configurations. Apache with 'mod-php' is not an exploitable configuration. (CVE-2012-2311, CVE-2012-2335, CVE-2012-2336)
 - An unspecified buffer overflow exists related to the function 'apache_request_headers'. (CVE-2012-2329)
 - An arbitrary code execution vulnerability which affects the function 'com_event_sink()' when processing a specially crafted COM object.

Versions of PHP 5.3.x prior to 5.3.13 are affected by a code execution vulnerability. The fix for CVE-2012-1823 does not completely correct the CGI query vulnerability. Disclosure of PHP source code and code execution via query paramenters are still possible.

Note, this vulnerability is exploitable only when PHP is used by CGI-based configurations. Apache with 'mod-php' is not an exploitable configuration.

The releases complete a fix for a vulnerability in CGI-based setups (CVE-2012-2311). PHP 5.4.3 fixes a buffer overflow vulnerability in the apache_request_headers() (CVE-2012-2329).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The releases complete a fix for a vulnerability in CGI-based setups (CVE-2012-2311).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PHP Development Team reports :

The release of PHP 5.4.13 and 5.4.3 complete a fix for the vulnerability in CGI-based setups as originally described in CVE-2012-1823. (CVE-2012-2311)

Note: mod_php and php-fpm are not vulnerable to this attack.

PHP 5.4.3 fixes a buffer overflow vulnerability in the apache_request_headers() (CVE-2012-2329).

De Eindbazen discovered that PHP, when run with mod_cgi, will interpret a query string as command line parameters, allowing to execute arbitrary code.

Additionally, this update fixes insufficient validation of upload name which lead to corrupted $_FILES indices.

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.3. It is, therefore, potentially affected the following vulnerabilities : 

  - The fix for CVE-2012-1823 does not completely correct     the CGI query parameter vulnerability. Disclosure of     PHP source code and code execution are still possible.
    Note that this vulnerability is exploitable only when     PHP is used in CGI-based configurations.  Apache with     'mod_php' is not an exploitable configuration.
    (CVE-2012-2311, CVE-2012-2335, CVE-2012-2336)

  - An unspecified buffer overflow exists related to the     function 'apache_request_headers'. (CVE-2012-2329)

According to its banner, the version of PHP installed on the remote host is 5.3.x earlier than 5.3.13 and, as such, is potentially affected by a remote code execution and information disclosure vulnerability.

The fix for CVE-2012-1823 does not completely correct the CGI query vulnerability. Disclosure of PHP source code and code execution via query parameters are still possible.

Note that this vulnerability is exploitable only when PHP is used in CGI-based configurations.  Apache with 'mod_php' is not an exploitable configuration.

This update fixes several security issues in PHP5 :

  - A directory traversal bug has been fixed in php5.
    (CVE-2012-1172)

  - A command injection was possible when PHP5 was operated     in CGI mode using commandline options. This problem does     not affect PHP5 in the normal Apache module mode setup.
    (CVE-2012-1823 / CVE-2012-2311)

  - Also a pack/unpacking bug on big endian 64bit     architectures (ppc64 and s390x) has been fixed.
    bnc#753778

It was discovered that PHP, when used as a stand alone CGI processor for the Apache Web Server, did not properly parse and filter query strings. This could allow a remote attacker to execute arbitrary code running with the privilege of the web server. Configurations using mod_php5 and FastCGI were not vulnerable.

This update addresses the issue when the PHP CGI interpreter is configured using mod_cgi and mod_actions as described in /usr/share/doc/php5-cgi/README.Debian.gz; however, if an alternate configuration is used to enable PHP CGI processing, it should be reviewed to ensure that command line arguments cannot be passed to the PHP interpreter. Please see CVE-2012-2311 for more details and potential mitigation approaches.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74616	openSUSE Security Update : php5 (openSUSE-SU-2012:0590-1)	Nessus	SuSE Local Security Checks	high
70728	Apache PHP-CGI Remote Code Execution	Nessus	CGI abuses	critical
69020	HP System Management Homepage < 7.2.1.0 Multiple Vulnerabilities (BEAST)	Nessus	Web Servers	high
64103	SuSE 11.2 Security Update : PHP5 (SAT Patch Number 6251)	Nessus	SuSE Local Security Checks	high
64099	SuSE 11.1 Security Update : PHP5 (SAT Patch Number 6252)	Nessus	SuSE Local Security Checks	high
62236	GLSA-201209-03 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
6584	Mac OS X 10.8 < 10.8.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
6583	Mac OS X 10.7 < 10.7.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
62215	Mac OS X 10.8.x < 10.8.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
62214	Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	critical
62213	Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)	Nessus	MacOS X Local Security Checks	critical
801100	PHP 5.3.x < 5.3.13 CGI Query String Code Execution	Log Correlation Engine	Web Servers	high
801071	PHP 5.3.x < 5.4.3 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
6495	PHP 5.4.x < 5.4.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
6494	PHP 5.3.x < 5.3.13 CGI Query String Code Execution	Nessus Network Monitor	Web Servers	high
59268	Fedora 17 : maniadrive-1.2-40.fc17 / php-5.4.3-1.fc17 (2012-7628)	Nessus	Fedora Local Security Checks	high
59266	Fedora 16 : maniadrive-1.2-32.fc16.5 / php-5.3.13-1.fc16 / php-eaccelerator-0.9.6.1-9.fc16.5 (2012-7586)	Nessus	Fedora Local Security Checks	high
59265	Fedora 15 : maniadrive-1.2-32.fc15.5 / php-5.3.13-1.fc15 / php-eaccelerator-0.9.6.1-9.fc15.5 (2012-7567)	Nessus	Fedora Local Security Checks	high
59088	PHP PHP-CGI Query String Parameter Injection Arbitrary Code Execution	Nessus	CGI abuses	high
59084	FreeBSD : php -- multiple vulnerabilities (59b68b1e-9c78-11e1-b5e0-000c299b62e1)	Nessus	FreeBSD Local Security Checks	high
59059	Debian DSA-2465-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
59057	PHP 5.4.x < 5.4.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
59056	PHP 5.3.x < 5.3.13 CGI Query String Code Execution	Nessus	CGI abuses	high
59053	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 8114)	Nessus	SuSE Local Security Checks	high
59016	Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : php5 vulnerability (USN-1437-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2012-2311

critical

Tenable Plugins

high

critical

high

high

high

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high