Buffer overflow in PCRE before 7.6 allows remote attackers to execute arbitrary code via a regular expression containing a character class with a large number of characters with Unicode code points greater than 255.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.8.  Mac OS X 10.5.8 contains security fixes for the following products : 

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launched
  - Login Window
  - MobileMe
  - Networking
  - XQuery

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.8. 

Mac OS X 10.5.8 contains security fixes for the following products :

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launchd
  - Login Window
  - MobileMe
  - Networking
  - XQuery

A buffer overflow in PCRE 7.x before 7.6 allows remote attackers to execute arbitrary code via a regular expression that contains a character class with a large number of characters with Unicode code points greater than 255.

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200811-05 (PHP: Multiple vulnerabilities)

    Several vulnerabilitites were found in PHP:
    PHP ships a     vulnerable version of the PCRE library which allows for the     circumvention of security restrictions or even for remote code     execution in case of an application which accepts user-supplied regular     expressions (CVE-2008-0674).
    Multiple crash issues in several     PHP functions have been discovered.
    Ryan Permeh reported that     the init_request_info() function in sapi/cgi/cgi_main.c does not     properly consider operator precedence when calculating the length of     PATH_TRANSLATED (CVE-2008-0599).
    An off-by-one error in the     metaphone() function may lead to memory corruption.
    Maksymilian Arciemowicz of SecurityReason Research reported an     integer overflow, which is triggerable using printf() and related     functions (CVE-2008-1384).
    Andrei Nigmatulin reported a     stack-based buffer overflow in the FastCGI SAPI, which has unknown     attack vectors (CVE-2008-2050).
    Stefan Esser reported that PHP     does not correctly handle multibyte characters inside the     escapeshellcmd() function, which is used to sanitize user input before     its usage in shell commands (CVE-2008-2051).
    Stefan Esser     reported that a short-coming in PHP's algorithm of seeding the random     number generator might allow for predictible random numbers     (CVE-2008-2107, CVE-2008-2108).
    The IMAP extension in PHP uses     obsolete c-client API calls making it vulnerable to buffer overflows as     no bounds checking can be done (CVE-2008-2829).
    Tavis Ormandy     reported a heap-based buffer overflow in pcre_compile.c in the PCRE     version shipped by PHP when processing user-supplied regular     expressions (CVE-2008-2371).
    CzechSec reported that specially     crafted font files can lead to an overflow in the imageloadfont()     function in ext/gd/gd.c, which is part of the GD extension     (CVE-2008-3658).
    Maksymilian Arciemowicz of SecurityReason     Research reported that a design error in PHP's stream wrappers allows     to circumvent safe_mode checks in several filesystem-related PHP     functions (CVE-2008-2665, CVE-2008-2666).
    Laurent Gaffie     discovered a buffer overflow in the internal memnstr() function, which     is used by the PHP function explode() (CVE-2008-3659).
    An     error in the FastCGI SAPI when processing a request with multiple dots     preceding the extension (CVE-2008-3660).
  Impact :

    These vulnerabilities might allow a remote attacker to execute     arbitrary code, to cause a Denial of Service, to circumvent security     restrictions, to disclose information, and to manipulate files.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. 

This security update contains fixes for the following products :

  - Apache
  - Certificates
  - ClamAV
  - ColorSync
  - CUPS
  - Finder
  - launchd
  - libxslt
  - MySQL Server
  - Networking
  - PHP
  - Postfix
  - PSNormalizer
  - QuickLook
  - rlogin
  - Script Editor
  - Single Sign-On
  - Tomcat
  - vim
  - Weblog

According to its banner, the version of PHP 4.x installed on the remote host is older than 4.4.9.  Such versions address several security issues, including : 

  - An update of PCRE to version 7.7.
  - An overflow in memnstr().
  - A crash in imageloadfont when an invalid font is given.
  - An open_basedir handling issue in the curl extension.
  - 'mbstring.func_overload' set in '.htaccess' becomes global.  Note that the release announcement states this will be the last release for the PHP 4.4 series.  

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-005 applied. 

This update contains security fixes for a number of programs.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.6.  Such versions may be affected by the following issues :

  - A stack buffer overflow in FastCGI SAPI.
  - An integer overflow in printf().
  - An unspecified security issue tracked by CVE-2008-0599.
  - A safe_mode bypass in cURL.
  - Incomplete handling of multibyte chars inside escapeshellcmd().
  - Issues in the bundled PCRE fixed by version 7.6.

The remote host is affected by the vulnerability described in GLSA-200803-24 (PCRE: Buffer overflow)

    PCRE contains a buffer overflow vulnerability when processing a     character class containing a very large number of characters with     codepoints greater than 255.
  Impact :

    A remote attacker could exploit this vulnerability by sending a     specially crafted regular expression to an application making use of     the PCRE library, which could possibly lead to the execution of     arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This update re-based pcre to version 7.3 as used in Fedora 8 to address multiple security issues that cause memory corruption, leading to application crash or possible execution of arbitrary code.
CVE-2007-1659 (#315871), CVE-2007-1661 (#392931), CVE-2007-1662 (#392921), CVE-2007-4766 (#392891), CVE-2007-4767 (#392901), CVE-2007-4768 (#392911), CVE-2008-0674 (#431660) This issue may affect usages of pcre, where regular expressions from untrusted sources are compiled. Handling of untrusted data using trusted regular expressions is not affected by these problems.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PCRE developers report :

A character class containing a very large number of characters with codepoints greater than 255 (in UTF-8 mode, of course) caused a buffer overflow.

It was discovered that PCRE did not correctly handle very long strings containing UTF8 sequences. In certain situations, an attacker could exploit applications linked against PCRE by tricking a user or automated system in processing a malicious regular expression leading to a denial of service or possibly arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that specially crafted regular expressions involving codepoints greater than 255 could cause a buffer overflow in the PCRE library (CVE-2008-0674 ).

This update addresses buffer overflow caused by a character class containing a very large number of characters with codepoints greater than 255 (in UTF-8 mode)

  - CVE-2008-0674, #431660 This issue may affect usages of     pcre, when regular expressions from untrusted sources     are compiled. Handling of untrusted data using trusted     regular expressions is not affected by this problem.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PCRE 7.6 fixed following bug: A character class containing a very large number of characters with codepoints greater than 255 (in UTF-8 mode, of course) caused a buffer overflow. The GLib release 2.14.6 updates the included copy of PCRE to version 7.6.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP installed on the remote host is older than 4.4.9.  Such versions address several security issues, including : 

  - An update of PCRE to version 7.7.
  - An overflow in memnstr().
  - A crash in imageloadfont when an invalid font is given.
  - An open_basedir handling issue in the curl extension.
  - 'mbstring.func_overload' set in '.htaccess' becomes global.  Note that the release announcement states this will be the last release for the PHP 4.4 series.

The version of PHP installed on the remote host is older than 5.2.6.  Such versions may be affected by the following issues :

  - A stack buffer overflow in FastCGI SAPI.
  - An integer overflow in printf().
  - An unspecified security issue tracked by CVE-2008-0599.
  - A safe_mode bypass in cURL.
  - Incomplete handling of multibyte chars inside escapeshellcmd().
  - Issues in the bundled PCRE fixed by version 7.6.

ID	Name	Product	Family	Severity
5122	Mac OS X 10.5 < 10.5.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
40502	Mac OS X 10.5.x < 10.5.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
36360	Mandriva Linux Security Advisory : pcre (MDVSA-2008:053)	Nessus	Mandriva Local Security Checks	high
34787	GLSA-200811-05 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
34374	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	Nessus	MacOS X Local Security Checks	critical
4620	PHP 4.x < 4.4.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
33790	Mac OS X Multiple Vulnerabilities (Security Update 2008-005)	Nessus	MacOS X Local Security Checks	critical
4493	PHP 5.x < 5.2.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
31611	GLSA-200803-24 : PCRE: Buffer overflow	Nessus	Gentoo Local Security Checks	high
31363	Fedora 7 : pcre-7.3-3.fc7 (2008-1842)	Nessus	Fedora Local Security Checks	high
31327	FreeBSD : pcre -- buffer overflow vulnerability (f9e96930-e6df-11dc-8c6a-00304881ac9a)	Nessus	FreeBSD Local Security Checks	high
31166	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : pcre3 vulnerability (USN-581-1)	Nessus	Ubuntu Local Security Checks	high
31143	Debian DSA-1499-1 : pcre3 - buffer overflow	Nessus	Debian Local Security Checks	high
31124	Fedora 8 : pcre-7.3-3.fc8 (2008-1783)	Nessus	Fedora Local Security Checks	high
31066	Fedora 8 : glib2-2.14.6-1.fc8 (2008-1533)	Nessus	Fedora Local Security Checks	high
801083	PHP < 4.4.9 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
801068	PHP < 5.2.6 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2008-0674

critical

Tenable Plugins

critical

critical

high

critical

critical

high

critical

high

high

high

high

high

high

high

high

high

high