Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1825 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Server.

    A stack-based buffer overflow flaw was found in the way the xmlrpc     extension parsed dates in the ISO 8601 format. A specially crafted XML-RPC     request or response could possibly cause a PHP application to crash or     execute arbitrary code with the privileges of the user running that PHP     application. (CVE-2014-8626)

    All php users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing the     updated packages, the httpd daemon must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.7.  Such versions may be affected by several security issues : 

  - Missing initialization of 'BG(page_uid)' and  'BG(page_gid)' when PHP is used as an Apache module may allow for bypassing security restrictions due to SAPI 'php_getuid()' overloading.

  - Incorrect 'php_value' order for Apache configuration may allow bypassing PHP's 'safe_mode' setting.

  - File truncation can occur when calling 'dba_replace()' with an invalid argument.

  - The ZipArchive: extractTo() method in the ZipArchive extension fails to filter directory traversal sequences from file names.

  - There is a buffer overflow in the bundled PCRE library fixed by 7.8. (CVE-2008-2371)

  - A buffer overflow in the 'imageloadfont()' function in 'ext/gd/gd.c' can be triggered when a specially crafted font is given. (CVE-2008-3658)

  - There is a buffer overflow in PHP's internal function 'memnstr()', which is exposed to userspace as 'explode()'. (CVE-2008-3659)

  - When used as a FastCGI module, PHP segfaults when opening a file whose name contains two dots (eg, 'file..php'). (CVE-2008-3660)

  - Multiple directory traversal vulnerabilities in functions such as 'posix_access()', 'chdir()', 'ftok()' may allow a remote attacker to bypass 'safe_mode' restrictions. (CVE-2008-2665 and CVE-2008-2666).

  - A buffer overflow may be triggered when processing long message headers in 'php_imap.c' due to use of an obsolete API call. (CVE-2008-2829)  - A buffer overflow error exists in the function 'date_from_ISO8601' function within file 'xmlrpc.c' because user-supplied input is improperly validated. This can be exploited by a remote attacker to cause a denial of service or to execute arbitrary code. (CVE-2014-8626)

A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_thumbnail() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application.
(CVE-2014-3670)

A stack-based buffer overflow flaw was found in the way the xmlrpc extension parsed dates in the ISO 8601 format. A specially crafted XML-RPC request or response could possibly cause a PHP application to crash. (CVE-2014-8626)

An integer overflow flaw was found in the way custom objects were unserialized. Specially crafted input processed by the unserialize() function could cause a PHP application to crash. (CVE-2014-3669)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_thumbnail() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application.
(CVE-2014-3670)

A stack-based buffer overflow flaw was found in the way the xmlrpc extension parsed dates in the ISO 8601 format. A specially crafted XML-RPC request or response could possibly cause a PHP application to crash. (CVE-2014-8626)

An integer overflow flaw was found in the way custom objects were unserialized. Specially crafted input processed by the unserialize() function could cause a PHP application to crash. (CVE-2014-3669)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1824 advisory.

    - core: fix integer overflow in unserialize() CVE-2014-3669
    - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP installed on the remote host is prior to 5.2.7. It is, therefore, affected by multiple vulnerabilities :

  - There is a buffer overflow flaw in the bundled PCRE     library that allows a denial of service attack.
    (CVE-2008-2371)

  - Multiple directory traversal vulnerabilities exist in     functions such as 'posix_access', 'chdir', and 'ftok'     that allow a remote attacker to bypass 'safe_mode'     restrictions. (CVE-2008-2665 and CVE-2008-2666).

  - A buffer overflow flaw in 'php_imap.c' may be triggered     when processing long message headers due to the use of     obsolete API calls. This can be exploited to cause a     denial of service or to execute arbitrary code.
    (CVE-2008-2829)

  - A buffer overflow in the 'imageloadfont' function in     'ext/gd/gd.c' can be triggered when a specially crafted     font is given. This can be exploited to cause a denial     of service or to execute arbitrary code. (CVE-2008-3658)

  - A buffer overflow flaw exists in PHP's internal function     'memnstr' which can be exploited by an attacker using     the delimiter argument to the 'explode' function. This     can be used to cause a denial of service or to execute     arbitrary code. (CVE-2008-3659)

  - When PHP is used as a FastCGI module, an attacker by     requesting a file whose file name extension is preceded     by multiple dots can cause a denial of service.
    (CVE-2008-3660)

  - A heap-based buffer overflow flaw in the mbstring     extension can be triggered via a specially crafted     string containing an HTML entity that is not handled     during Unicode conversion. This can be exploited to     execute arbitrary code.(CVE-2008-5557)

  - Improper initialization of global variables 'page_uid'     and 'page_gid' when PHP is used as an Apache module     allows the bypassing of security restriction due to     SAPI 'php_getuid' function overloading. (CVE-2008-5624)

  - PHP does not enforce the correct restrictions when     'safe_mode' is enabled through a 'php_admin_flag'     setting in 'httpd.conf'. This allows an attacker, by     placing a specially crafted 'php_value' entry in     '.htaccess', to able to write to arbitrary files.
    (CVE-2008-5625)

  - The 'ZipArchive::extractTo' function in the ZipArchive     extension fails to filter directory traversal sequences     from file names. An attacker can exploit this to write     to arbitrary files. (CVE-2008-5658)

  - Under limited circumstances, an attacker can cause a     file truncation to occur when calling the 'dba_replace'     function with an invalid argument. (CVE-2008-7068)

  - A buffer overflow error exists in the function     'date_from_ISO8601' function within file 'xmlrpc.c'     because user-supplied input is improperly validated.
    This can be exploited by a remote attacker to cause a     denial of service or to execute arbitrary code.
    (CVE-2014-8626)

ID	Name	Product	Family	Severity
210168	RHEL 4 : php (RHSA-2014:1825)	Nessus	Red Hat Local Security Checks	critical
4779	PHP 5.x < 5.2.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
79082	Scientific Linux Security Update : php on SL5.x i386/x86_64 (20141106)	Nessus	Scientific Linux Local Security Checks	high
78909	RHEL 5 : php (RHSA-2014:1824)	Nessus	Red Hat Local Security Checks	high
78908	Oracle Linux 5 : php (ELSA-2014-1824)	Nessus	Oracle Linux Local Security Checks	critical
78895	CentOS 5 : php (CESA-2014:1824)	Nessus	CentOS Local Security Checks	high
35043	PHP 5 < 5.2.7 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2014-8626

critical

Tenable Plugins

critical

high

high

high

critical

high

high