The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.

The remote host is missing Security Update 2005-001. This security update contains a number of enhancements for the following programs :

 - at commands
 - ColorSync
 - libxml2
 - Mail
 - PHP
 - Safari
 - SquirrelMail
 

he remote host is missing Security Update 2005-001. This security update contains a number of fixes for the following programs :

  - at commands
  - ColorSync
  - libxml2
  - Mail
  - PHP
  - Safari
  - SquirrelMail

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

According to its banner, the version of PHP 4.3.x installed on the remote host is prior to 4.3.2.   It is, therefore, potentially affected by an information disclosure vulnerability.

Due to a flaw in the function php_safe_mode_include_dir(), a local attacker could bypass safe mode and gain unauthorized access to files on the local system.

ID	Name	Product	Family	Severity
2555	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus Network Monitor	Web Clients	critical
16251	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus	MacOS X Local Security Checks	high
11807	PHP < 4.3.3 php_check_safe_mode_include_dir Function Safemode Bypass	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2003-0863

critical

Tenable Plugins

critical

high

medium