PHP 5.4.x < 5.4.38 / 5.5.x < 5.5.22 / 5.6.x < 5.6.6 Multiple Vulnerabilities (GHOST)

critical Nessus Network Monitor Plugin ID 8677

Synopsis

The remote web server uses a version of PHP that is affected by multiple vulnerabilities.

Description

Versions of PHP 5.4.x earlier than 5.4.38, 5.5.x earlier than 5.5.22, or 5.6.x earlier than 5.6.6 are exposed to the following issues :

- A heap-based buffer overflow flaw in the GNU C Library (glibc) due to improperly validating user-supplied input in the glibc functions __nss_hostname_digits_dots(), gethostbyname(), and gethostbyname2(). This allows a remote attacker to cause a buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (GHOST) (Bug 68925 / CVE-2015-0235)

- A use-after-free flaw exists in the function php_date_timezone_initialize_from_hash() within the 'ext/date/php_date.c' script. An attacker can exploit this to access sensitive information or crash applications linked to PHP. (Bug 68942 / CVE-2015-0273)

- A use-after-free flaw exists in the function 'phar_rename_archive' in the source file 'phar_object.c'. An attacker can cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file. (Bug 68901 / CVE-2015-2301)

- A heap-based buffer overflow flaw affects the 'enchant_broker_request_dict' function in the source file 'ext/enchant/enchant.c'. This allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries. (Bug 68552 / CVE-2014-9705)

Solution

Apply the vendor patch or upgrade to PHP version 5.6.6 or later. If 5.6.x cannot be installed, 5.4.38 and 5.5.22 are also patched for these vulnerabilities.

Plugin Details

Severity: Critical

ID: 8677

Family: Web Servers

Published: 4/9/2015

Updated: 3/6/2019

Nessus ID: 81510, 81511, 81512

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:php:php

Patch Publication Date: 2/19/2015

Vulnerability Publication Date: 1/12/2015

Exploitable With

Core Impact

Metasploit (Exim GHOST (glibc gethostbyname) Buffer Overflow)

Reference Information

CVE: CVE-2014-9705, CVE-2015-0235, CVE-2015-0273, CVE-2015-2301

BID: 72701, 73037, 73034, 73031, 72325

Detections

Analytics