exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting level, which causes significant stack recursion.

Updated PHP packages that fix various security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A bug was found in the way PHP processes IFF and JPEG images. It is possible to cause PHP to consume CPU resources for a short period of time by supplying a carefully crafted IFF or JPEG image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0524 and CVE-2005-0525 to these issues.

A buffer overflow bug was also found in the way PHP processes EXIF image headers. It is possible for an attacker to construct an image file in such a way it could execute arbitrary instructions when processed by PHP. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1042 to this issue.

A denial of service bug was found in the way PHP processes EXIF image headers. It is possible for an attacker to cause PHP to enter an infinite loop for a short period of time by supplying a carefully crafted image file to PHP for processing. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1043 to this issue.

Several bug fixes are also included in this update :

  - some performance issues in the unserialize() function     have been fixed

  - the behaviour of the interpreter when handling integer     overflow during conversion of a floating variable to an     integer has been reverted to match the behaviour used     upstream; the integer will now be wrapped rather than     truncated

  - a fix for the virtual() function in the Apache httpd     module which would flush the response prematurely

  - the hard-coded default 'safe mode' setting is now     'disabled' rather than 'enabled'; to match the default     /etc/php.ini setting

  - in the curl extension, safe mode was not enforced for     'file:///' URL lookups (CVE-2004-1392).

Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues.

Updated PHP packages that fix various security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A bug was found in the way PHP processes IFF and JPEG images. It is possible to cause PHP to consume CPU resources for a short period of time by supplying a carefully crafted IFF or JPEG image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0524 and CVE-2005-0525 to these issues.

A buffer overflow bug was also found in the way PHP processes EXIF image headers. It is possible for an attacker to construct an image file in such a way that it could execute arbitrary instructions when processed by PHP. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1042 to this issue.

A denial of service bug was found in the way PHP processes EXIF image headers. It is possible for an attacker to cause PHP to enter an infinite loop for a short period of time by supplying a carefully crafted image file to PHP for processing. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1043 to this issue.

Several bug fixes are also included in this update :

  - The security fixes in RHSA-2004-687 to the     'unserializer' code introduced some performance issues.

  - In the gd extension, the 'imagecopymerge' function did     not correctly handle transparency. The original image     was being obscured in the resultant image.

  - In the curl extension, safe mode was not enforced for     'file:///' URL lookups (CVE-2004-1392).

Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues.

An integer overflow was discovered in the exif_process_IFD_TAG() function in PHP4's EXIF module. EXIF tags with a specially crafted 'Image File Directory' (IFD) tag caused a buffer overflow which could have been exploited to execute arbitrary code with the privileges of the PHP4 server. (CAN-2005-1042)

The same module also contained a Denial of Service vulnerability. EXIF headers with a large IFD nesting level caused an unbound recursion which would eventually overflow the stack and cause the executed program to crash. (CAN-2005-1043)

In web applications that automatically process EXIF tags of uploaded images, both vulnerabilities could be exploited remotely.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is missing Security Update 2005-006. This security update contains security fixes for the following application :

- AFP Server
- Bluetooth
- CoreGraphics
- Folder Permissions
- launchd
- LaunchServices
- NFS
- PHP
- VPN

These programs have multiple vulnerabilities, some of which may lead to arbitrary code execution.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:406 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Web server.

    A bug was found in the way PHP processes IFF and JPEG images. It is     possible to cause PHP to consume CPU resources for a short period of time     by supplying a carefully crafted IFF or JPEG image. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the     names CAN-2005-0524 and CAN-2005-0525 to these issues.

    A buffer overflow bug was also found in the way PHP processes EXIF image     headers. It is possible for an attacker to construct an image file in such     a way it could execute arbitrary instructions when processed by PHP. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-1042 to this issue.

    A denial of service bug was found in the way PHP processes EXIF image     headers. It is possible for an attacker to cause PHP to enter an infinite     loop for a short period of time by supplying a carefully crafted image file     to PHP for processing. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-1043 to this issue.

    Several bug fixes are also included in this update:

    - some performance issues in the unserialize() function have been fixed

    - the behaviour of the interpreter when handling integer overflow during     conversion of a floating variable to an integer has been reverted to match     the behaviour used upstream; the integer will now be wrapped rather than     truncated

    - a fix for the virtual() function in the Apache httpd module which would     flush the response prematurely

    - the hard-coded default safe mode setting is now disabled rather than     enabled; to match the default /etc/php.ini setting

    - in the curl extension, safe mode was not enforced for 'file:///' URL     lookups (CAN-2004-1392).

    Users of PHP should upgrade to these updated packages, which contain     backported fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A number of vulnerabilities are addressed in this PHP update :

Stefano Di Paolo discovered integer overflows in PHP's pack(), unpack(), and shmop_write() functions which could allow a malicious script to break out of safe mode and execute arbitrary code with privileges of the PHP interpreter (CVE-2004-1018; this was previously fixed in Mandrakelinux >= 10.0 in MDKSA-2004:151).

Stefan Esser discovered two safe mode bypasses which would allow malicious scripts to circumvent path restrictions by using virtual_popen() with a current directory containing shell meta- characters (CVE-2004-1063) or by creating a specially crafted directory whose length exceeded the capacity of realpath() (CVE-2004-1064; both of these were previously fixed in Mandrakelinux >= 10.0 in MDKSA-2004:151).

Two Denial of Service vulnerabilities were found in the getimagesize() function which uses the format-specific internal functions php_handle_iff() and php_handle_jpeg() which would get stuck in infinite loops when certain (invalid) size parameters are read from the image (CVE-2005-0524 and CVE-2005-0525).

An integer overflow was discovered in the exif_process_IFD_TAG() function in PHP's EXIF module. EXIF tags with a specially crafted 'Image File Directory' (IFD) tag would cause a buffer overflow which could be exploited to execute arbitrary code with the privileges of the PHP server (CVE-2005-1042).

Another vulnerability in the EXIF module was also discovered where headers with a large IFD nesting level would cause an unbound recursion which would eventually overflow the stack and cause the executed program to crash (CVE-2004-1043).

All of these issues are addressed in the Corporate Server 2.1 packages and the last three issues for all other platforms, which had previously included the first two issues but had not been mentioned in MDKSA-2004:151.

The remote host is affected by the vulnerability described in GLSA-200504-15 (PHP: Multiple vulnerabilities)

    An integer overflow and an unbound recursion were discovered in     the processing of Image File Directory tags in PHP's EXIF module     (CAN-2005-1042, CAN-2005-1043). Furthermore, two infinite loops have     been discovered in the getimagesize() function when processing IFF or     JPEG images (CAN-2005-0524, CAN-2005-0525).
  Impact :

    A remote attacker could craft an image file with a malicious EXIF     IFD tag, a large IFD nesting level or invalid size parameters and send     it to a web application that would process this user-provided image     using one of the affected functions. This could result in denying     service on the attacked server and potentially executing arbitrary code     with the rights of the web server.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of PHP that is older than 4.3.11 or 5.0.4.  This version contains a bug that can be triggered when the getimagesize() function processes malicious IFF or JPEG image files.  An attacker exploiting this flaw would be able to present an image to the function that would cause the function to go into an infinite loop by processing a negative file size.  A successful exploit would result in the loss of system availability for valid users.  There is also a reported flaw in the way that PHP handles data being passed to the Image File Directory (IFD).  Reportedly, this leads to a remote Denial of Service (DoS) attack.   Other flaws impacting this version of PHP have been reported; however, details have not been released.

ID	Name	Product	Family	Severity
23981	CentOS 4 : PHP (CESA-2005:406)	Nessus	CentOS Local Security Checks	high
21818	CentOS 3 : PHP (CESA-2005:405)	Nessus	CentOS Local Security Checks	high
20499	Ubuntu 4.10 : php4 vulnerabilities (USN-112-1)	Nessus	Ubuntu Local Security Checks	high
18437	Mac OS X Multiple Vulnerabilities (Security Update 2005-006)	Nessus	MacOS X Local Security Checks	high
18198	RHEL 4 : PHP (RHSA-2005:406)	Nessus	Red Hat Local Security Checks	high
18163	RHEL 3 : PHP (RHSA-2005:405)	Nessus	Red Hat Local Security Checks	high
18091	Mandrake Linux Security Advisory : php (MDKSA-2005:072)	Nessus	Mandriva Local Security Checks	critical
18081	GLSA-200504-15 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
2782	PHP Remote getimagesize DoS	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2005-1043

high

Tenable Plugins

high

high

high

high

high

high

critical

high

high