Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions.

Updated PHP packages that fix a security issue are now available. 

This update has been rated as having important security impact by the Red Hat Security Response Team. 

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. 

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.  These packages also contain a fix for a bug where certain input strings to the metaphone() function could cause memory corruption. 


From Red Hat Security Advisory 2006:0730 :

The Hardened-PHP Project discovered an overflow in the PHP htmlentities() and htmlspecialchars() routines. If a PHP script used the vulnerable functions to parse UTF-8 data, a remote attacker sending a carefully crafted request could trigger the overflow and potentially execute arbitrary code as the 'apache' user.
(CVE-2006-5465)


From Red Hat Security Advisory 2006:0669 :

A response-splitting issue was discovered in the PHP session handling.
If a remote attacker can force a carefully crafted session identifier to be used, a cross-site-scripting or response-splitting attack could be possible. (CVE-2006-3016)

A buffer overflow was discovered in the PHP sscanf() function. If a script used the sscanf() function with positional arguments in the format string, a remote attacker sending a carefully crafted request could execute arbitrary code as the 'apache' user. (CVE-2006-4020)

An integer overflow was discovered in the PHP wordwrap() and str_repeat() functions. If a script running on a 64-bit server used either of these functions on untrusted user data, a remote attacker sending a carefully crafted request might be able to cause a heap overflow. (CVE-2006-4482)

A buffer overflow was discovered in the PHP gd extension. If a script was set up to process GIF images from untrusted sources using the gd extension, a remote attacker could cause a heap overflow.
(CVE-2006-4484)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly, which could allow a denial of service attack by a remote user. (CVE-2006-4486)

Updated PHP packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

The Hardened-PHP Project discovered an overflow in the PHP htmlentities() and htmlspecialchars() routines. If a PHP script used the vulnerable functions to parse UTF-8 data, a remote attacker sending a carefully crafted request could trigger the overflow and potentially execute arbitrary code as the 'apache' user.
(CVE-2006-5465)

Users of PHP should upgrade to these updated packages which contain a backported patch to correct this issue.

 According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.0.  Such versions may be affected by several buffer overflows To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script to the remote server, or to be able to manipulate several variables processed by some PHP functions such as htmlentities(). 

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.  Such versions may be affected by several buffer overflows. 

To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script on the remote server or to manipulate several variables processed by some PHP functions such as 'htmlentities().'

This update fixes the following security problems in the PHP scripting language :

  - Various buffer overflows in     htmlentities/htmlspecialchars internal routines could be     used to crash the PHP interpreter or potentially execute     code, depending on the PHP application used.
    (CVE-2006-5465)

  - A missing open_basedir check inside chdir() function was     added.

  - A tempnam() openbasedir bypass was fixed.

  - A possible buffer overflow in stream_socket_client()     when using 'bindto' + IPv6 was fixed.

  - Do not build php5 with --enable-sigchld.

Stefan Esser discovered two buffer overflows in the htmlentities() and htmlspecialchars() functions. By supplying specially crafted input to PHP applications which process that input with these functions, a remote attacker could potentially exploit this to execute arbitrary code with the privileges of the application. (CVE-2006-5465)

This update also fixes bugs in the chdir() and tempnam() functions, which did not perform proper open_basedir checks. This could allow local scripts to bypass intended restrictions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security problems in the PHP scripting language :

  - CVE-2006-5465: Various buffer overflows in     htmlentities/htmlspecialchars internal routines could be     used to crash the PHP interpreter or potentially execute     code, depending on the PHP application used.

  - A missing open_basedir check inside chdir() function was     added.

  - A tempnam() openbasedir bypass was fixed.

  - A possible buffer overflow in stream_socket_client()     when using 'bindto' + IPv6 was fixed.

  - Do not build php5 with --enable-sigchld.

The remote host is affected by the vulnerability described in GLSA-200703-21 (PHP: Multiple vulnerabilities)

    Several vulnerabilities were found in PHP by the Hardened-PHP Project     and other researchers. These vulnerabilities include a heap-based     buffer overflow in htmlentities() and htmlspecialchars() if called with     UTF-8 parameters, and an off-by-one error in str_ireplace(). Other     vulnerabilities were also found in the PHP4 branch, including possible     overflows, stack corruptions and a format string vulnerability in the
    *print() functions on 64 bit systems.
  Impact :

    Remote attackers might be able to exploit these issues in PHP     applications making use of the affected functions, potentially     resulting in the execution of arbitrary code, Denial of Service,     execution of scripted contents in the context of the affected site,     security bypass or information leak.
  Workaround :

    There is no known workaround at this time.

The Hardened-PHP Project discovered buffer overflows in htmlentities/htmlspecialchars internal routines to the PHP Project.
The purpose of these functions is to be filled with user input. (The overflow can only be when UTF-8 is used) (CVE-2006-5465)

Unspecified vulnerabilities in PHP, probably before 5.2.0, allow local users to bypass open_basedir restrictions and perform unspecified actions via unspecified vectors involving the (1) chdir and (2) tempnam functions. NOTE: the tempnam vector might overlap CVE-2006-1494. (CVE-2006-5706)

Updated packages have been patched to correct these issues. Users must restart Apache for the changes to take effect.

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-3353     Tim Starling discovered that missing input sanitising in     the EXIF module could lead to denial of service.

  - CVE-2006-3017     Stefan Esser discovered a security-critical programming     error in the hashtable implementation of the internal     Zend engine.

  - CVE-2006-4482     It was discovered that str_repeat() and wordwrap()     functions perform insufficient checks for buffer     boundaries on 64 bit systems, which might lead to the     execution of arbitrary code.

  - CVE-2006-5465     Stefan Esser discovered a buffer overflow in the     htmlspecialchars() and htmlentities(), which might lead     to the execution of arbitrary code.

New php packages are available for Slackware 10.2 and 11.0 to fix security issues.

ID	Name	Product	Family	Severity
67421	Oracle Linux 4 : php (ELSA-2006-0730 / ELSA-2006-0669)	Nessus	Oracle Linux Local Security Checks	high
37281	CentOS 3 / 4 : php (CESA-2006:0730)	Nessus	CentOS Local Security Checks	high
4444	PHP 5.x < 5.2.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
31649	PHP 5.x < 5.2 Multiple Vulnerabilities	Nessus	CGI abuses	high
29376	SuSE 10 Security Update : PHP (ZYPP Patch Number 2236)	Nessus	SuSE Local Security Checks	high
27956	Ubuntu 5.10 / 6.06 LTS / 6.10 : php5 vulnerability (USN-375-1)	Nessus	Ubuntu Local Security Checks	high
27148	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-2238)	Nessus	SuSE Local Security Checks	high
24887	GLSA-200703-21 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
24581	Mandrake Linux Security Advisory : php (MDKSA-2006:196)	Nessus	Mandriva Local Security Checks	high
23655	Debian DSA-1206-1 : php4 - several vulnerabilities	Nessus	Debian Local Security Checks	high
23653	Slackware 10.2 / 11.0 : php (SSA:2006-307-01)	Nessus	Slackware Local Security Checks	high
23631	RHEL 2.1 / 3 / 4 : php (RHSA-2006:0730)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2006-5465

critical

Tenable Plugins

high

high

high

high

high

high

high

critical

high

high

high

high