Detections
Analytics
CentOS 3 / 4 : php (CESA-2007:0155)
high Nessus Plugin ID 25043
Synopsis
The remote CentOS host is missing one or more security updates.Description
Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.This update has been rated as having important security impact by the Red Hat Security Response Team.
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.
A denial of service flaw was found in the way PHP processed a deeply nested array. A remote attacker could cause the PHP interpreter to crash by submitting an input variable with a deeply nested array.
(CVE-2007-1285)
A flaw was found in the way PHP's unserialize() function processed data. If a remote attacker was able to pass arbitrary data to PHP's unserialize() function, they could possibly execute arbitrary code as the apache user. (CVE-2007-1286)
A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection.
(CVE-2007-1583)
A double free flaw was found in PHP's session_decode() function. If a remote attacker was able to pass arbitrary data to PHP's session_decode() function, they could possibly execute arbitrary code as the apache user. (CVE-2007-1711)
A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718)
A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution.
(CVE-2007-1001)
A buffer over-read flaw was discovered in PHP's gd extension. A script that could be forced to write arbitrary string using a JIS font from an untrusted source could cause the PHP interpreter to crash.
(CVE-2007-0455)
Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.
Solution
Update the affected php packages.See Also
http://www.nessus.org/u?5aa1da2d
http://www.nessus.org/u?00b4b6bf
http://www.nessus.org/u?b57e934e
http://www.nessus.org/u?84a6c30c
Plugin Details
Severity: High
ID: 25043
File Name: centos_RHSA-2007-0155.nasl
Version: 1.21
Type: local
Agent: unix
Family: CentOS Local Security Checks
Published: 4/19/2007
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.3
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N
Vulnerability Information
CPE: p-cpe:/a:centos:centos:php-mysql, p-cpe:/a:centos:centos:php, p-cpe:/a:centos:centos:php-odbc, p-cpe:/a:centos:centos:php-gd, p-cpe:/a:centos:centos:php-devel, p-cpe:/a:centos:centos:php-pgsql, p-cpe:/a:centos:centos:php-ldap, cpe:/o:centos:centos:3, p-cpe:/a:centos:centos:php-pear, p-cpe:/a:centos:centos:php-domxml, p-cpe:/a:centos:centos:php-snmp, p-cpe:/a:centos:centos:php-xmlrpc, cpe:/o:centos:centos:4, p-cpe:/a:centos:centos:php-ncurses, p-cpe:/a:centos:centos:php-mbstring, p-cpe:/a:centos:centos:php-imap
Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/17/2007
Vulnerability Publication Date: 1/30/2007
Exploitable With
Metasploit (PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie))
Reference Information
CVE: CVE-2007-0455, CVE-2007-1001, CVE-2007-1285, CVE-2007-1286, CVE-2007-1583, CVE-2007-1711, CVE-2007-1718