The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1824 advisory.

    - core: fix integer overflow in unserialize() CVE-2014-3669
    - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_thumbnail() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application.
(CVE-2014-3670)

A stack-based buffer overflow flaw was found in the way the xmlrpc extension parsed dates in the ISO 8601 format. A specially crafted XML-RPC request or response could possibly cause a PHP application to crash. (CVE-2014-8626)

An integer overflow flaw was found in the way custom objects were unserialized. Specially crafted input processed by the unserialize() function could cause a PHP application to crash. (CVE-2014-3669)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_thumbnail() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application.
(CVE-2014-3670)

A stack-based buffer overflow flaw was found in the way the xmlrpc extension parsed dates in the ISO 8601 format. A specially crafted XML-RPC request or response could possibly cause a PHP application to crash. (CVE-2014-8626)

An integer overflow flaw was found in the way custom objects were unserialized. Specially crafted input processed by the unserialize() function could cause a PHP application to crash. (CVE-2014-3669)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1825 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Server.

    A stack-based buffer overflow flaw was found in the way the xmlrpc     extension parsed dates in the ISO 8601 format. A specially crafted XML-RPC     request or response could possibly cause a PHP application to crash or     execute arbitrary code with the privileges of the user running that PHP     application. (CVE-2014-8626)

    All php users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing the     updated packages, the httpd daemon must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP installed on the remote host is prior to 5.2.7. It is, therefore, affected by multiple vulnerabilities :

  - There is a buffer overflow flaw in the bundled PCRE     library that allows a denial of service attack.
    (CVE-2008-2371)

  - Multiple directory traversal vulnerabilities exist in     functions such as 'posix_access', 'chdir', and 'ftok'     that allow a remote attacker to bypass 'safe_mode'     restrictions. (CVE-2008-2665 and CVE-2008-2666).

  - A buffer overflow flaw in 'php_imap.c' may be triggered     when processing long message headers due to the use of     obsolete API calls. This can be exploited to cause a     denial of service or to execute arbitrary code.
    (CVE-2008-2829)

  - A buffer overflow in the 'imageloadfont' function in     'ext/gd/gd.c' can be triggered when a specially crafted     font is given. This can be exploited to cause a denial     of service or to execute arbitrary code. (CVE-2008-3658)

  - A buffer overflow flaw exists in PHP's internal function     'memnstr' which can be exploited by an attacker using     the delimiter argument to the 'explode' function. This     can be used to cause a denial of service or to execute     arbitrary code. (CVE-2008-3659)

  - When PHP is used as a FastCGI module, an attacker by     requesting a file whose file name extension is preceded     by multiple dots can cause a denial of service.
    (CVE-2008-3660)

  - A heap-based buffer overflow flaw in the mbstring     extension can be triggered via a specially crafted     string containing an HTML entity that is not handled     during Unicode conversion. This can be exploited to     execute arbitrary code.(CVE-2008-5557)

  - Improper initialization of global variables 'page_uid'     and 'page_gid' when PHP is used as an Apache module     allows the bypassing of security restriction due to     SAPI 'php_getuid' function overloading. (CVE-2008-5624)

  - PHP does not enforce the correct restrictions when     'safe_mode' is enabled through a 'php_admin_flag'     setting in 'httpd.conf'. This allows an attacker, by     placing a specially crafted 'php_value' entry in     '.htaccess', to able to write to arbitrary files.
    (CVE-2008-5625)

  - The 'ZipArchive::extractTo' function in the ZipArchive     extension fails to filter directory traversal sequences     from file names. An attacker can exploit this to write     to arbitrary files. (CVE-2008-5658)

  - Under limited circumstances, an attacker can cause a     file truncation to occur when calling the 'dba_replace'     function with an invalid argument. (CVE-2008-7068)

  - A buffer overflow error exists in the function     'date_from_ISO8601' function within file 'xmlrpc.c'     because user-supplied input is improperly validated.
    This can be exploited by a remote attacker to cause a     denial of service or to execute arbitrary code.
    (CVE-2014-8626)

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.7.  Such versions may be affected by several security issues : 

  - Missing initialization of 'BG(page_uid)' and  'BG(page_gid)' when PHP is used as an Apache module may allow for bypassing security restrictions due to SAPI 'php_getuid()' overloading.

  - Incorrect 'php_value' order for Apache configuration may allow bypassing PHP's 'safe_mode' setting.

  - File truncation can occur when calling 'dba_replace()' with an invalid argument.

  - The ZipArchive: extractTo() method in the ZipArchive extension fails to filter directory traversal sequences from file names.

  - There is a buffer overflow in the bundled PCRE library fixed by 7.8. (CVE-2008-2371)

  - A buffer overflow in the 'imageloadfont()' function in 'ext/gd/gd.c' can be triggered when a specially crafted font is given. (CVE-2008-3658)

  - There is a buffer overflow in PHP's internal function 'memnstr()', which is exposed to userspace as 'explode()'. (CVE-2008-3659)

  - When used as a FastCGI module, PHP segfaults when opening a file whose name contains two dots (eg, 'file..php'). (CVE-2008-3660)

  - Multiple directory traversal vulnerabilities in functions such as 'posix_access()', 'chdir()', 'ftok()' may allow a remote attacker to bypass 'safe_mode' restrictions. (CVE-2008-2665 and CVE-2008-2666).

  - A buffer overflow may be triggered when processing long message headers in 'php_imap.c' due to use of an obsolete API call. (CVE-2008-2829)  - A buffer overflow error exists in the function 'date_from_ISO8601' function within file 'xmlrpc.c' because user-supplied input is improperly validated. This can be exploited by a remote attacker to cause a denial of service or to execute arbitrary code. (CVE-2014-8626)

ID	Name	Product	Family	Published	Updated	Severity
78908	Oracle Linux 5 : php (ELSA-2014-1824)	Nessus	Oracle Linux Local Security Checks	11/7/2014	10/22/2024	critical
79082	Scientific Linux Security Update : php on SL5.x i386/x86_64 (20141106)	Nessus	Scientific Linux Local Security Checks	11/10/2014	1/14/2021	high
78909	RHEL 5 : php (RHSA-2014:1824)	Nessus	Red Hat Local Security Checks	11/7/2014	1/14/2021	high
210168	RHEL 4 : php (RHSA-2014:1825)	Nessus	Red Hat Local Security Checks	11/4/2024	11/4/2024	critical
35043	PHP 5 < 5.2.7 Multiple Vulnerabilities	Nessus	CGI abuses	12/5/2008	5/28/2024	high
78895	CentOS 5 : php (CESA-2014:1824)	Nessus	CentOS Local Security Checks	11/7/2014	1/4/2021	high
4779	PHP 5.x < 5.2.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	11/17/2014	3/6/2019	high

Detections

Analytics

Plugins Search

critical

high

high

critical

high

high

high