PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended safe_mode_exec_dir via shell metacharacters in the current directory name. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

Stefano Di Paola discovered integer overflows in PHP's pack() and unpack() functions. A malicious PHP script could exploit these to break out of safe mode and execute arbitrary code with the privileges of the PHP interpreter. (CAN-2004-1018)

Note: The second part of CAN-2004-1018 (buffer overflow in the shmop_write() function) was already fixed in USN-66-1.

Stefan Esser discovered two safe mode bypasses which allowed malicious PHP scripts to circumvent path restrictions. This was possible by either using virtual_popen() with a current directory containing shell metacharacters (CAN-2004-1063) or creating a specially crafted directory whose length exceeded the capacity of the realpath() function (CAN-2004-1064).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A number of vulnerabilities are addressed in this PHP update :

Stefano Di Paolo discovered integer overflows in PHP's pack(), unpack(), and shmop_write() functions which could allow a malicious script to break out of safe mode and execute arbitrary code with privileges of the PHP interpreter (CVE-2004-1018; this was previously fixed in Mandrakelinux >= 10.0 in MDKSA-2004:151).

Stefan Esser discovered two safe mode bypasses which would allow malicious scripts to circumvent path restrictions by using virtual_popen() with a current directory containing shell meta- characters (CVE-2004-1063) or by creating a specially crafted directory whose length exceeded the capacity of realpath() (CVE-2004-1064; both of these were previously fixed in Mandrakelinux >= 10.0 in MDKSA-2004:151).

Two Denial of Service vulnerabilities were found in the getimagesize() function which uses the format-specific internal functions php_handle_iff() and php_handle_jpeg() which would get stuck in infinite loops when certain (invalid) size parameters are read from the image (CVE-2005-0524 and CVE-2005-0525).

An integer overflow was discovered in the exif_process_IFD_TAG() function in PHP's EXIF module. EXIF tags with a specially crafted 'Image File Directory' (IFD) tag would cause a buffer overflow which could be exploited to execute arbitrary code with the privileges of the PHP server (CVE-2005-1042).

Another vulnerability in the EXIF module was also discovered where headers with a large IFD nesting level would cause an unbound recursion which would eventually overflow the stack and cause the executed program to crash (CVE-2004-1043).

All of these issues are addressed in the Corporate Server 2.1 packages and the last three issues for all other platforms, which had previously included the first two issues but had not been mentioned in MDKSA-2004:151.

The remote host is missing Security Update 2005-001. This security update contains a number of enhancements for the following programs :

 - at commands
 - ColorSync
 - libxml2
 - Mail
 - PHP
 - Safari
 - SquirrelMail
 

he remote host is missing Security Update 2005-001. This security update contains a number of fixes for the following programs :

  - at commands
  - ColorSync
  - libxml2
  - Mail
  - PHP
  - Safari
  - SquirrelMail

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200412-14 (PHP: Multiple vulnerabilities)

    Stefan Esser and Marcus Boerger reported several different issues in     the unserialize() function, including serious exploitable bugs in the     way it handles negative references (CAN-2004-1019).
    Stefan Esser also discovered that the pack() and unpack() functions are     subject to integer overflows that can lead to a heap buffer overflow     and a heap information leak. Finally, he found that the way     multithreaded PHP handles safe_mode_exec_dir restrictions can be     bypassed, and that various path truncation issues also allow to bypass     path and safe_mode restrictions.
    Ilia Alshanetsky found a stack overflow issue in the exif_read_data()     function (CAN-2004-1065). Finally, Daniel Fabian found that addslashes     and magic_quotes_gpc do not properly escape null characters and that     magic_quotes_gpc contains a bug that could lead to one level directory     traversal.
  Impact :

    These issues could be exploited by a remote attacker to retrieve web     server heap information, bypass safe_mode or path restrictions and     potentially execute arbitrary code with the rights of the web server     running a PHP application.
  Workaround :

    There is no known workaround at this time.

A number of vulnerabilities in PHP versions prior to 4.3.10 were discovered by Stefan Esser. Some of these vulnerabilities were not deemed to be severe enough to warrant CVE names, however the packages provided, with the exception of the Corporate Server 2.1 packages, include fixes for all of the vulnerabilities, thanks to the efforts of the OpenPKG team who extracted and backported the fixes.

The vulnerabilities fixed in all provided packages include a fix for a possible information disclosure, double free, and negative reference index array underflow in deserialization code (CVE-2004-1019). As well, the exif_read_data() function suffers from an overflow on a long sectionname; this vulnerability was discovered by Ilia Alshanetsky (CVE-2004-1065).

The other fixes that appear in Mandrakelinux 9.2 and newer packages include a fix for out of bounds memory write access in shmop_write() and integer overflow/underflows in the pack() and unpack() functions.
The addslashes() function did not properly escape '&#0;' correctly. A directory bypass issue existed in safe_mode execution. There is an issue of arbitrary file access through path truncation. Finally, the 'magic_quotes_gpc' functionality could lead to one level directory traversal with file uploads.

According to its banner, the version of PHP installed on the remote host is prior to 4.3.10 / 5.0.3.  It is, therefore, affected by multiple security issues that could, under certain circumstances, allow an attacker to execute arbitrary code on the remote host, provided that the attacker can pass arbitrary data to some functions, or to bypass safe_mode.

The remote host is running a version of PHP which is older than 5.0.3 or 4.3.10.
The remote version of this software is vulnerable to various security issues that may, under certain circumstances, allow attackers to execute arbitrary code on the remote host, provided that they can pass arbitrary data to some functions or bypass safe_mode.

ID	Name	Product	Family	Severity
20725	Ubuntu 4.10 : php4 vulnerabilities (USN-99-1)	Nessus	Ubuntu Local Security Checks	critical
18091	Mandrake Linux Security Advisory : php (MDKSA-2005:072)	Nessus	Mandriva Local Security Checks	critical
2555	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus Network Monitor	Web Clients	critical
16251	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus	MacOS X Local Security Checks	high
16001	GLSA-200412-14 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
15998	Mandrake Linux Security Advisory : php (MDKSA-2004:151)	Nessus	Mandriva Local Security Checks	critical
15973	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	Nessus	CGI abuses	high
2460	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical

Detections

Analytics

CVE-2004-1063

high

Tenable Plugins

critical

critical

critical

high

critical

critical

high

critical