Detections
Analytics
Ubuntu 9.04 : php5 vulnerabilities (USN-761-2)
medium Nessus Plugin ID 38194
Synopsis
The remote Ubuntu host is missing one or more security-related patches.Description
USN-761-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 9.04.It was discovered that PHP did not sanitize certain error messages when display_errors is enabled, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain.
(CVE-2008-5814)
It was discovered that PHP did not properly handle certain malformed strings when being parsed by the json_decode function. A remote attacker could exploit this flaw and cause the PHP server to crash, resulting in a denial of service. This issue only affected Ubuntu 8.04 and 8.10.
(CVE-2009-1271).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 38194
File Name: ubuntu_USN-761-2.nasl
Version: 1.13
Type: local
Agent: unix
Family: Ubuntu Local Security Checks
Published: 4/28/2009
Updated: 1/19/2021
Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5, p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5filter, p-cpe:/a:canonical:ubuntu_linux:php-pear, p-cpe:/a:canonical:ubuntu_linux:php5, p-cpe:/a:canonical:ubuntu_linux:php5-cgi, p-cpe:/a:canonical:ubuntu_linux:php5-cli, p-cpe:/a:canonical:ubuntu_linux:php5-common, p-cpe:/a:canonical:ubuntu_linux:php5-curl, p-cpe:/a:canonical:ubuntu_linux:php5-dbg, p-cpe:/a:canonical:ubuntu_linux:php5-dev, p-cpe:/a:canonical:ubuntu_linux:php5-gd, p-cpe:/a:canonical:ubuntu_linux:php5-gmp, p-cpe:/a:canonical:ubuntu_linux:php5-ldap, p-cpe:/a:canonical:ubuntu_linux:php5-mhash, p-cpe:/a:canonical:ubuntu_linux:php5-mysql, p-cpe:/a:canonical:ubuntu_linux:php5-odbc, p-cpe:/a:canonical:ubuntu_linux:php5-pgsql, p-cpe:/a:canonical:ubuntu_linux:php5-pspell, p-cpe:/a:canonical:ubuntu_linux:php5-recode, p-cpe:/a:canonical:ubuntu_linux:php5-snmp, p-cpe:/a:canonical:ubuntu_linux:php5-sqlite, p-cpe:/a:canonical:ubuntu_linux:php5-sybase, p-cpe:/a:canonical:ubuntu_linux:php5-tidy, p-cpe:/a:canonical:ubuntu_linux:php5-xmlrpc, p-cpe:/a:canonical:ubuntu_linux:php5-xsl, cpe:/o:canonical:ubuntu_linux:9.04
Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l
Patch Publication Date: 4/27/2009
Reference Information
CVE: CVE-2008-5814, CVE-2009-1271