The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Admin Framework
 - Apache
 - ATS
 - Certificate Trust Policy
 - CFNetwork HTTPProtocol
 - CFNetwork Session
 - CFURL
 - CoreAnimation
 - FontParser
 - Graphics Driver
 - Hypervisor
 - ImageIO
 - IOHIDFamily
 - Kernel
 - LaunchServices
 - libnetcore
 - ntp
 - Open Directory Client
 - OpenLDAP
 - OpenSSL
 - PHP
 - QuickLook
 - SceneKit
 - ScreenSharing
 - Security - Code SIgning
 - UniformTypeIdentifiers
 - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This update fixes the following issues :

  - memory corruption in openssl_parse_x509 (CVE-2013-6420)

  - Heap buffer over-read in DateInterval (CVE-2013-6712)

  - man-in-the-middle attacks by specially crafting     certificates (CVE-2013-4248)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - Security - Code SIgning
  - UniformTypeIdentifiers

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - Apache
  - ATS
  - Certificate Trust Policy
  - CFNetwork HTTPProtocol
  - CFNetwork Session
  - CFURL
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - Hypervisor
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libnetcore
  - ntp
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - ScreenSharing
  - Security - Code SIgning
  - UniformTypeIdentifiers
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote Solaris system is missing necessary patches to address security updates :

  - The openssl_x509_parse function in openssl.c in the     OpenSSL module in PHP before 5.4.18 and 5.5.x before     5.5.2 does not properly handle a '\0' character in a     domain name in the Subject Alternative Name field of an     X.509 certificate, which allows man-in-the-middle     attackers to spoof arbitrary SSL servers via a crafted     certificate issued by a legitimate Certification     Authority, a related issue to CVE-2009-2408.
    (CVE-2013-4248)

  - The asn1_time_to_time_t function in     ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before     5.4.23, and 5.5.x before 5.5.7 does not properly parse     (1) notBefore and (2) notAfter timestamps in X.509     certificates, which allows remote attackers to execute     arbitrary code or cause a denial of service (memory     corruption) via a crafted certificate that is not     properly handled by the openssl_x509_parse function.
    (CVE-2013-6420)

  - The scan function in ext/date/lib/parse_iso_intervals.c     in PHP through 5.5.6 does not properly restrict creation     of DateInterval objects, which might allow remote     attackers to cause a denial of service (heap-based     buffer over-read) via a crafted interval specification.
    (CVE-2013-6712)

  - Fine Free file before 5.17 allows context-dependent     attackers to cause a denial of service (infinite     recursion, CPU consumption, and crash) via a crafted     indirect offset value in the magic of a file.
    (CVE-2014-1943)

  - softmagic.c in file before 5.17 and libmagic allows     context-dependent attackers to cause a denial of service     (out-of-bounds memory access and crash) via crafted     offsets in the softmagic of a PE executable.
    (CVE-2014-2270)

According to its banner, the version of PHP installed on the remote host is a development version of 5.6.0. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash.

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query.

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is affected by the following vulnerabilities :

  - A flaw exists within the included cURL that disables the     'CURLOPT_SSLVERIFYHOST' check when the setting on     'CURLOPT_SSL_VERIFYPEER' is disabled. This can allow a     remote attacker to disable SSL certificate host name     checks. (CVE-2013-4545)

  - A flaw exists in the included PHP 'openssl_x509_parse'     function due to user input not being properly sanitized.
    Using a specially crafted certificate, a remote attacker     can exploit this to cause a denial of service or execute     arbitrary code. (CVE-2013-6420)

  - A flaw exists within the included cURL where the     verification check for the CN and SAN name fields is     skipped due to the digital signature verification being     disabled. A remote attacker can exploit this to spoof     servers or conduct a man-in-the-middle attack.
    (CVE-2013-6422)

  - A flaw exists in the scan function within the included     PHP 'ext/date/lib/parse_iso_intervals.c' script where     user input is not properly sanitized. This can allow a     remote attacker to cause a denial of service using a     heap-based buffer overflow. (CVE-2013-6712)

  - An unspecified cross-site scripting flaw exists which     can allow a remote attacker, using a specially crafted     request, to execute arbitrary code within the     browser / server trust relationship. (CVE-2014-2640)

  - An unspecified cross-site request forgery vulnerability     exists. (CVE-2014-2641)

  - An unspecified vulnerability exists that can allow     a remote attacker to conduct clickjacking attacks.
    (CVE-2014-2642)

The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker can cause arbitrary code execution, create       a Denial of Service condition, read or write arbitrary files, impersonate       other servers, hijack a web session, or have other unspecified impact.
      Additionally, a local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of PHP installed on the remote host is 5.3.x prior to 5.3.29. It is, therefore, affected by the following vulnerabilities :

  - A heap-based buffer overflow error exists in the file     'ext/date/lib/parse_iso_intervals.c' related to handling     DateInterval objects that allows denial of service     attacks. (CVE-2013-6712)

  - A boundary checking error exists related to the Fileinfo     extension, Composite Document Format (CDF) handling, and     the function 'cdf_read_short_sector'. (CVE-2014-0207)

  - A flaw exists with the 'cdf_unpack_summary_info()'     function within 'src/cdf.c' where multiple file_printf     calls occur when handling specially crafted CDF files.
    This could allow a context dependent attacker to crash     the web application using PHP. (CVE-2014-0237)

  - A flaw exists with the 'cdf_read_property_info()'     function within 'src/cdf.c' where an infinite loop     occurs when handling specially crafted CDF files. This     could allow a context dependent attacker to crash the     web application using PHP. (CVE-2014-0238)

  - A type-confusion error exists related to the Standard     PHP Library (SPL) extension and the function     'unserialize'. (CVE-2014-3515)

  - An error exists related to configuration scripts and     temporary file handling that could allow insecure file     usage. (CVE-2014-3981)

  - A heap-based buffer overflow error exists related to the     function 'dns_get_record' that could allow execution of     arbitrary code. (CVE-2014-4049)

  - An out-of-bounds read exists in printf. (Bug #67249)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

Additionally, note that version 5.3.29 marks the end of support for the PHP 5.3.x branch.

The PHP Team reports :

insecure temporary file use in the configure script

unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion

Heap buffer over-read in DateInterval

fileinfo: cdf_read_short_sector insufficient boundary check

fileinfo: CDF infinite loop in nelements DoS

fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation)

Fix potential segfault in dns_check_record()

Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU.
(CVE-2014-1943, CVE-2014-2270)

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049)

A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721)

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712)

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1012 advisory.

    - core: type confusion issue in phpinfo(). CVE-2014-4721
    - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
    - core: fix heap-based buffer overflow in DNS TXT record parsing.
      CVE-2014-4049
    - core: unserialize() SPL ArrayObject / SPLObjectStorage type       confusion flaw. CVE-2014-3515
    - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
    - fileinfo: unrestricted recursion in handling of indirect type       rules. CVE-2014-1943
    - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
    - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
    - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
    - fileinfo: cdf_unpack_summary_info() excessive looping       DoS. CVE-2014-0237

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file.

Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU.
(CVE-2014-1943, CVE-2014-2270)

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049)

A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721)

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712)

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)

The CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, and CVE-2014-3480 issues were discovered by Francisco Alonso of Red Hat Product Security.

All php53 and php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

- security update

  - CVE-2013-6420.patch [bnc#854880]

  - CVE-2013-6712.patch [bnc#853045]

  - CVE-2013-4248.patch [bnc#837746]

Multiple vulnerabilities has been discovered and corrected in php :

The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2013-4248).

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function (CVE-2013-6420).

The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification (CVE-2013-6712).

The updated php packages have been upgraded to the 5.5.8 version which is not vulnerable to these issues.

Additionally, the PECL packages which requires so has been rebuilt for php-5.5.8 and some has been upgraded to their latest versions.

This update fixes the following issues :

  - memory corruption in openssl_parse_x509. (CVE-2013-6420)

  - Heap buffer over-read in DateInterval. (CVE-2013-6712)

  - man-in-the-middle attacks by specially crafting     certificates (CVE-2013-4248)

According to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.8.  It is, therefore, potentially affected by the following vulnerabilities :

  - A heap-based buffer overflow error exists in the file     'ext/date/lib/parse_iso_intervals.c' related to     handling DateInterval objects that could allow denial     of service attacks. (CVE-2013-6712)

  - An integer overflow error exists in the function     'exif_process_IFD_TAG' in the file 'ext/exif/exif.c'     that could allow denial of service attacks or arbitrary     memory reads. (Bug #65873)

  - A use-after-free error exists in the function     'do_soap_call' in the file 'ext/soap/soap.c' related     to 'typemap' values and error handling and having     unspecified impact. (Bug #66112)

Note that this plugin does not attempt to exploit the vulnerabilities, but instead relies only on PHP's self-reported version number.

According to its banner, the version of PHP 5.4.x installed on the remote host is a version prior to 5.4.24.  It is, therefore, potentially affected by the following vulnerabilities :

  - A heap-based buffer overflow error exists in the file     'ext/date/lib/parse_iso_intervals.c' related to     handling DateInterval objects that could allow denial     of service attacks. (CVE-2013-6712)

  - An integer overflow error exists in the function     'exif_process_IFD_TAG' in the file 'ext/exif/exif.c'     that could allow denial of service attacks or arbitrary     memory reads. (Bug #65873)

Note that this plugin does not attempt to exploit the vulnerabilities, but instead relies only on PHP's self-reported version number.

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2013-6420     Stefan Esser reported possible memory corruption in     openssl_x509_parse().

  - CVE-2013-6712     Creating DateInterval objects from parsed ISO dates was     not properly restricted, which allowed to cause a denial     of service.

In addition, the update for Debian 7 'Wheezy' contains several bugfixes originally targeted for the upcoming Wheezy point release.

Stefan Esser discovered that PHP incorrectly parsed certificates. An attacker could use a malformed certificate to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2013-6420)

It was discovered that PHP incorrectly handled DateInterval objects.
An attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2013-6712).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
700510	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
83607	SUSE SLES11 Security Update : PHP5 (SUSE-SU-2014:0064-1)	Nessus	SuSE Local Security Checks	high
82700	Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)	Nessus	MacOS X Local Security Checks	critical
82699	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)	Nessus	MacOS X Local Security Checks	critical
80737	Oracle Solaris Third-Party Patch Update : php (cve_2013_4248_input_validation)	Nessus	Solaris Local Security Checks	high
78556	PHP 5.6.0 Multiple Vulnerabilities	Nessus	CGI abuses	high
78336	Amazon Linux AMI : php (ALAS-2014-393)	Nessus	Amazon Linux Local Security Checks	high
78090	HP System Management Homepage < 7.4 Multiple Vulnerabilities	Nessus	Web Servers	high
77455	GLSA-201408-11 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
77285	PHP 5.3.x < 5.3.29 Multiple Vulnerabilities	Nessus	CGI abuses	high
77241	FreeBSD : PHP multiple vulnerabilities (d2a892b9-2605-11e4-9da0-00a0986f28c4)	Nessus	FreeBSD Local Security Checks	high
77047	Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20140806)	Nessus	Scientific Linux Local Security Checks	high
77043	Oracle Linux 5 / 6 : php53 / and / php (ELSA-2014-1012)	Nessus	Oracle Linux Local Security Checks	medium
77032	CentOS 5 / 6 : php / php53 (CESA-2014:1012)	Nessus	CentOS Local Security Checks	high
77015	RHEL 5 / 6 : php53 and php (RHSA-2014:1012)	Nessus	Red Hat Local Security Checks	high
74876	openSUSE Security Update : php5 (openSUSE-SU-2013:1963-1)	Nessus	SuSE Local Security Checks	high
72082	Mandriva Linux Security Advisory : php (MDVSA-2014:014)	Nessus	Mandriva Local Security Checks	high
71965	SuSE 11.2 / 11.3 Security Update : PHP5 (SAT Patch Numbers 8683 / 8684)	Nessus	SuSE Local Security Checks	high
71928	PHP 5.5.x < 5.5.8 Multiple Vulnerabilities	Nessus	CGI abuses	medium
71927	PHP 5.4.x < 5.4.24 Multiple Vulnerabilities	Nessus	CGI abuses	medium
71402	Debian DSA-2816-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
71394	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 / 13.10 : php5 vulnerabilities (USN-2055-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2013-6712

critical

Tenable Plugins

critical

high

critical

critical

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

medium

medium

high

high