The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.

The remote Solaris system is missing necessary patches to address security updates :

  - Session fixation vulnerability in the Sessions subsystem     in PHP before 5.5.2 allows remote attackers to hijack     web sessions by specifying a session ID. (CVE-2011-4718)

  - Unspecified vulnerability in the _php_stream_scandir     function in the stream implementation in PHP before     5.3.15 and 5.4.x before 5.4.5 has unknown impact and     remote attack vectors, related to an 'overflow.'     (CVE-2012-2688)

  - The SQLite functionality in PHP before 5.3.15 allows     remote attackers to bypass the open_basedir protection     mechanism via unspecified vectors. (CVE-2012-3365)

  - ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before     5.4.13 does not validate the relationship between the     soap.wsdl_cache_dir directive and the open_basedir     directive, which allows remote attackers to bypass     intended access restrictions by triggering the creation     of cached SOAP WSDL files in an arbitrary directory.
    (CVE-2013-1635)

  - The SOAP parser in PHP before 5.3.23 and 5.4.x before     5.4.13 allows remote attackers to read arbitrary files     via a SOAP WSDL file containing an XML external entity     declaration in conjunction with an entity reference,     related to an XML External Entity (XXE) issue in the     soap_xmlParseFile and soap_xmlParseMemory functions.
    NOTE: this vulnerability exists because of an incorrect     fix for CVE-2013-1824. (CVE-2013-1643)

  - Heap-based buffer overflow in the php_quot_print_encode     function in ext/ standard/quot_print.c in PHP before     5.3.26 and 5.4.x before 5.4.16 allows remote attackers     to cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     argument to the quoted_printable_encode function.
    (CVE-2013-2110)

  - ext/xml/xml.c in PHP before 5.3.27 does not properly     consider parsing depth, which allows remote attackers to     cause a denial of service (heap memory corruption) or     possibly have unspecified other impact via a crafted     document that is processed by the xml_parse_into_struct     function. (CVE-2013-4113)

  - The openssl_x509_parse function in openssl.c in the     OpenSSL module in PHP before 5.4.18 and 5.5.x before     5.5.2 does not properly handle a '\0' character in a     domain name in the Subject Alternative Name field of an     X.509 certificate, which allows man-in-the-middle     attackers to spoof arbitrary SSL servers via a crafted     certificate issued by a legitimate Certification     Authority, a related issue to CVE-2009-2408.
    (CVE-2013-4248)

  - Integer overflow in the SdnToJewish function in jewish.c     in the Calendar component in PHP before 5.3.26 and 5.4.x     before 5.4.16 allows context-dependent attackers to     cause a denial of service (application hang) via a large     argument to the jdtojewish function. (CVE-2013-4635)

  - The mget function in libmagic/softmagic.c in the     Fileinfo component in PHP 5.4.x before 5.4.16 allows     remote attackers to cause a denial of service (invalid     pointer dereference and application crash) via an MP3     file that triggers incorrect MIME type detection during     access to an finfo object. (CVE-2013-4636)

The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker can cause arbitrary code execution, create       a Denial of Service condition, read or write arbitrary files, impersonate       other servers, hijack a web session, or have other unspecified impact.
      Additionally, a local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

PHP versions earlier than 5.4.16 and 5.3.26 are affected by a heap based buffer overflow vulnerability due to lack of user input sanitation when parsing strings. (An additional security vulnerability exists while parsing 'mimetype' for MP3 files, which can be exploited to cause a crash in version 5.4.15.)

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.16.  It is, therefore, potentially affected by the following vulnerabilities:

  - An error exists in the mimetype detection of 'mp3' files     that could lead to a denial of service. (Bug #64830)

  - An error exists in the function 'php_quot_print_encode'     in the file 'ext/standard/quot_print.c' that could allow     a heap-based buffer overflow when attempting to parse     certain strings. (Bug #64879)

  - An integer overflow error exists related to the value     of 'JEWISH_SDN_MAX' in the file 'ext/calendar/jewish.c'     that could allow denial of service attacks. (Bug #64895)

Note that this plugin does not attempt to exploit these vulnerabilities, but instead relies only on PHP's self-reported version number.

ID	Name	Product	Family	Severity
80736	Oracle Solaris Third-Party Patch Update : php (cve_2013_4113_buffer_errors)	Nessus	Solaris Local Security Checks	critical
77455	GLSA-201408-11 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
6866	PHP < 5.3.26 / 5.4.x < 5.4.16 Heap Based Buffer Overflow	Nessus Network Monitor	Web Servers	medium
66843	PHP 5.4.x < 5.4.16 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2013-4636

medium

Tenable Plugins

critical

high

medium

medium