Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safe_mode are feasible.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.7.  Such versions may be affected by several security issues : 

  - Missing initialization of 'BG(page_uid)' and  'BG(page_gid)' when PHP is used as an Apache module may allow for bypassing security restrictions due to SAPI 'php_getuid()' overloading.

  - Incorrect 'php_value' order for Apache configuration may allow bypassing PHP's 'safe_mode' setting.

  - File truncation can occur when calling 'dba_replace()' with an invalid argument.

  - The ZipArchive: extractTo() method in the ZipArchive extension fails to filter directory traversal sequences from file names.

  - There is a buffer overflow in the bundled PCRE library fixed by 7.8. (CVE-2008-2371)

  - A buffer overflow in the 'imageloadfont()' function in 'ext/gd/gd.c' can be triggered when a specially crafted font is given. (CVE-2008-3658)

  - There is a buffer overflow in PHP's internal function 'memnstr()', which is exposed to userspace as 'explode()'. (CVE-2008-3659)

  - When used as a FastCGI module, PHP segfaults when opening a file whose name contains two dots (eg, 'file..php'). (CVE-2008-3660)

  - Multiple directory traversal vulnerabilities in functions such as 'posix_access()', 'chdir()', 'ftok()' may allow a remote attacker to bypass 'safe_mode' restrictions. (CVE-2008-2665 and CVE-2008-2666).

  - A buffer overflow may be triggered when processing long message headers in 'php_imap.c' due to use of an obsolete API call. (CVE-2008-2829)  - A buffer overflow error exists in the function 'date_from_ISO8601' function within file 'xmlrpc.c' because user-supplied input is improperly validated. This can be exploited by a remote attacker to cause a denial of service or to execute arbitrary code. (CVE-2014-8626)

This update fixes some overflows in the gd extension and the memnstr() function that could crash php or even cause a buffer overflow.
(CVE-2008-3658 / CVE-2008-3659 / CVE-2008-3660)

CVE-2008-3658, CVE-2008-3659 and CVE-2008-3660 have been fixed in the php5 update.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

A buffer overflow in the imageloadfont() function in PHP allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via a crafted font file (CVE-2008-3658).

A buffer overflow in the memnstr() function allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via the delimiter argument to the explode() function (CVE-2008-3659).

PHP, when used as a FastCGI module, allowed remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension (CVE-2008-3660).

An array index error in the imageRotate() function in PHP allowed context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument to the function for an indexed image (CVE-2008-5498).

The updated packages have been patched to correct these issues.

It was discovered that PHP did not properly enforce php_admin_value and php_admin_flag restrictions in the Apache configuration file. A local attacker could create a specially crafted PHP script that would bypass intended security restrictions. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. (CVE-2007-5900)

It was discovered that PHP did not correctly handle certain malformed font files. If a PHP application were tricked into processing a specially crafted font file, an attacker may be able to cause a denial of service and possibly execute arbitrary code with application privileges. (CVE-2008-3658)

It was discovered that PHP did not properly check the delimiter argument to the explode function. If a script passed untrusted input to the explode function, an attacker could cause a denial of service and possibly execute arbitrary code with application privileges.
(CVE-2008-3659) 

It was discovered that PHP, when used as FastCGI module, did not properly sanitize requests. By performing a request with multiple dots preceding the extension, an attacker could cause a denial of service.
(CVE-2008-3660)

It was discovered that PHP did not properly handle Unicode conversion in the mbstring extension. If a PHP application were tricked into processing a specially crafted string containing an HTML entity, an attacker could execute arbitrary code with application privileges.
(CVE-2008-5557)

It was discovered that PHP did not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function.
An attacker could exploit this issue to bypass safe_mode restrictions.
(CVE-2008-5624)

It was dicovered that PHP did not properly enforce error_log safe_mode restrictions when set by php_admin_flag in the Apache configuration file. A local attacker could create a specially crafted PHP script that would overwrite arbitrary files. (CVE-2008-5625)

It was discovered that PHP contained a flaw in the ZipArchive::extractTo function. If a PHP application were tricked into processing a specially crafted zip file that had filenames containing '..', an attacker could write arbitrary files within the filesystem.
This issue only applied to Ubuntu 7.10, 8.04 LTS, and 8.10.
(CVE-2008-5658)

USN-557-1 fixed a vulnerability in the GD library. When using the GD library, PHP did not properly handle the return codes that were added in the security update. An attacker could exploit this issue with a specially crafted image file and cause PHP to crash, leading to a denial of service. This issue only applied to Ubuntu 6.06 LTS, and 7.10. (CVE-2007-3996).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in PHP allowed context-dependent attackers to cause a denial of service (crash) via a certain long string in the glob() or fnmatch() functions (CVE-2007-4782).

A vulnerability in the cURL library in PHP allowed context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files using a special URL request (CVE-2007-4850).

An integer overflow in PHP allowed context-dependent attackers to cause a denial of serivce via a special printf() format parameter (CVE-2008-1384).

A stack-based buffer overflow in the FastCGI SAPI in PHP has unknown impact and attack vectors (CVE-2008-2050).

A buffer overflow in the imageloadfont() function in PHP allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via a crafted font file (CVE-2008-3658).

A buffer overflow in the memnstr() function allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via the delimiter argument to the explode() function (CVE-2008-3659).

PHP, when used as a FastCGI module, allowed remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension (CVE-2008-3660).

An array index error in the imageRotate() function in PHP allowed context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument to the function for an indexed image (CVE-2008-5498).

The updated packages have been patched to correct these issues.

Secunia reports :

Some vulnerabilities have been reported in PHP, where some have an unknown impact and others can potentially be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

An input validation error exists within the 'ZipArchive::extractTo()' function when extracting ZIP archives. This can be exploited to extract files to arbitrary locations outside the specified directory via directory traversal sequences in a specially crafted ZIP archive.

An error in the included PCRE library can be exploited to cause a buffer overflow.

The problem is that the 'BG(page_uid)' and 'BG(page_gid)' variables are not initialized. No further information is currently available.

The problem is that the 'php_value' order is incorrect for Apache configurations. No further information is currently available.

An error in the GD library can be exploited to cause a crash via a specially crafted font file.

According to its banner, the version of PHP installed on the remote host is prior to 5.2.7. It is, therefore, affected by multiple vulnerabilities :

  - There is a buffer overflow flaw in the bundled PCRE     library that allows a denial of service attack.
    (CVE-2008-2371)

  - Multiple directory traversal vulnerabilities exist in     functions such as 'posix_access', 'chdir', and 'ftok'     that allow a remote attacker to bypass 'safe_mode'     restrictions. (CVE-2008-2665 and CVE-2008-2666).

  - A buffer overflow flaw in 'php_imap.c' may be triggered     when processing long message headers due to the use of     obsolete API calls. This can be exploited to cause a     denial of service or to execute arbitrary code.
    (CVE-2008-2829)

  - A buffer overflow in the 'imageloadfont' function in     'ext/gd/gd.c' can be triggered when a specially crafted     font is given. This can be exploited to cause a denial     of service or to execute arbitrary code. (CVE-2008-3658)

  - A buffer overflow flaw exists in PHP's internal function     'memnstr' which can be exploited by an attacker using     the delimiter argument to the 'explode' function. This     can be used to cause a denial of service or to execute     arbitrary code. (CVE-2008-3659)

  - When PHP is used as a FastCGI module, an attacker by     requesting a file whose file name extension is preceded     by multiple dots can cause a denial of service.
    (CVE-2008-3660)

  - A heap-based buffer overflow flaw in the mbstring     extension can be triggered via a specially crafted     string containing an HTML entity that is not handled     during Unicode conversion. This can be exploited to     execute arbitrary code.(CVE-2008-5557)

  - Improper initialization of global variables 'page_uid'     and 'page_gid' when PHP is used as an Apache module     allows the bypassing of security restriction due to     SAPI 'php_getuid' function overloading. (CVE-2008-5624)

  - PHP does not enforce the correct restrictions when     'safe_mode' is enabled through a 'php_admin_flag'     setting in 'httpd.conf'. This allows an attacker, by     placing a specially crafted 'php_value' entry in     '.htaccess', to able to write to arbitrary files.
    (CVE-2008-5625)

  - The 'ZipArchive::extractTo' function in the ZipArchive     extension fails to filter directory traversal sequences     from file names. An attacker can exploit this to write     to arbitrary files. (CVE-2008-5658)

  - Under limited circumstances, an attacker can cause a     file truncation to occur when calling the 'dba_replace'     function with an invalid argument. (CVE-2008-7068)

  - A buffer overflow error exists in the function     'date_from_ISO8601' function within file 'xmlrpc.c'     because user-supplied input is improperly validated.
    This can be exploited by a remote attacker to cause a     denial of service or to execute arbitrary code.
    (CVE-2014-8626)

New php packages are available for Slackware 12.0, 12.1, and -current to fix security issues, as well as make improvements and fix bugs.

The remote host is affected by the vulnerability described in GLSA-200811-05 (PHP: Multiple vulnerabilities)

    Several vulnerabilitites were found in PHP:
    PHP ships a     vulnerable version of the PCRE library which allows for the     circumvention of security restrictions or even for remote code     execution in case of an application which accepts user-supplied regular     expressions (CVE-2008-0674).
    Multiple crash issues in several     PHP functions have been discovered.
    Ryan Permeh reported that     the init_request_info() function in sapi/cgi/cgi_main.c does not     properly consider operator precedence when calculating the length of     PATH_TRANSLATED (CVE-2008-0599).
    An off-by-one error in the     metaphone() function may lead to memory corruption.
    Maksymilian Arciemowicz of SecurityReason Research reported an     integer overflow, which is triggerable using printf() and related     functions (CVE-2008-1384).
    Andrei Nigmatulin reported a     stack-based buffer overflow in the FastCGI SAPI, which has unknown     attack vectors (CVE-2008-2050).
    Stefan Esser reported that PHP     does not correctly handle multibyte characters inside the     escapeshellcmd() function, which is used to sanitize user input before     its usage in shell commands (CVE-2008-2051).
    Stefan Esser     reported that a short-coming in PHP's algorithm of seeding the random     number generator might allow for predictible random numbers     (CVE-2008-2107, CVE-2008-2108).
    The IMAP extension in PHP uses     obsolete c-client API calls making it vulnerable to buffer overflows as     no bounds checking can be done (CVE-2008-2829).
    Tavis Ormandy     reported a heap-based buffer overflow in pcre_compile.c in the PCRE     version shipped by PHP when processing user-supplied regular     expressions (CVE-2008-2371).
    CzechSec reported that specially     crafted font files can lead to an overflow in the imageloadfont()     function in ext/gd/gd.c, which is part of the GD extension     (CVE-2008-3658).
    Maksymilian Arciemowicz of SecurityReason     Research reported that a design error in PHP's stream wrappers allows     to circumvent safe_mode checks in several filesystem-related PHP     functions (CVE-2008-2665, CVE-2008-2666).
    Laurent Gaffie     discovered a buffer overflow in the internal memnstr() function, which     is used by the PHP function explode() (CVE-2008-3659).
    An     error in the FastCGI SAPI when processing a request with multiple dots     preceding the extension (CVE-2008-3660).
  Impact :

    These vulnerabilities might allow a remote attacker to execute     arbitrary code, to cause a Denial of Service, to circumvent security     restrictions, to disclose information, and to manipulate files.
  Workaround :

    There is no known workaround at this time.

This update fixes some overflows in the gd extension and the memnstr() function that could crash php or even cause a buffer overflow (CVE-2008-3658 / CVE-2008-3659) In addition it fixes a bug in gd support. (bnc#411272)

Several vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-3658     Buffer overflow in the imageloadfont function allows a     denial of service or code execution through a crafted     font file.

  - CVE-2008-3659     Buffer overflow in the memnstr function allows a denial     of service or code execution via a crafted delimiter     parameter to the explode function.

  - CVE-2008-3660     Denial of service is possible in the FastCGI module by a     remote attacker by making a request with multiple dots     before the extension.

According to its banner, the version of PHP 4.x installed on the remote host is older than 4.4.9.  Such versions address several security issues, including : 

  - An update of PCRE to version 7.7.
  - An overflow in memnstr().
  - A crash in imageloadfont when an invalid font is given.
  - An open_basedir handling issue in the curl extension.
  - 'mbstring.func_overload' set in '.htaccess' becomes global.  Note that the release announcement states this will be the last release for the PHP 4.4 series.  

According to its banner, the version of PHP installed on the remote host is older than 4.4.9.  Such versions may be affected by several security issues :

  - There are unspecified issues in the bundled PCRE library     fixed by version 7.7.

  - A buffer overflow in the 'imageloadfont()' function in     'ext/gd/gd.c' can be triggered when a specially crafted     font is given. (CVE-2008-3658)

  - A buffer overflow exists in the internal 'memnstr()'     function, which is exposed to userspace as 'explode()'.
    (CVE-2008-3659)

  - A denial of service vulnerability exists when a     filename contains 2 dots. (CVE-2008-3660)

  - An 'open_basedir' handling issue in the curl extension.

  - 'mbstring.func_overload' set in '.htaccess' becomes     global. (CVE-2009-0754)

Note that the release announcement states this will be the last release for the PHP 4.4 series.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	Name	Product	Family	Severity
4779	PHP 5.x < 5.2.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
41474	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 5580)	Nessus	SuSE Local Security Checks	high
39913	openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-168)	Nessus	SuSE Local Security Checks	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
37701	Mandriva Linux Security Advisory : php (MDVSA-2009:021)	Nessus	Mandriva Local Security Checks	high
36665	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : php5 vulnerabilities (USN-720-1)	Nessus	Ubuntu Local Security Checks	critical
36294	Mandriva Linux Security Advisory : php (MDVSA-2009:022)	Nessus	Mandriva Local Security Checks	critical
35051	FreeBSD : php -- multiple vulnerabilities (27d01223-c457-11dd-a721-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
35043	PHP 5 < 5.2.7 Multiple Vulnerabilities	Nessus	CGI abuses	high
35035	Slackware 12.0 / 12.1 / current : php (SSA:2008-339-01)	Nessus	Slackware Local Security Checks	high
34787	GLSA-200811-05 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
34429	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 5661)	Nessus	SuSE Local Security Checks	high
34355	Debian DSA-1647-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
34233	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-5546)	Nessus	SuSE Local Security Checks	high
4620	PHP 4.x < 4.4.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
33849	PHP < 4.4.9 Multiple Vulnerabilities	Nessus	CGI abuses	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2008-3659

critical

Tenable Plugins

high

high

high

critical

high

critical

critical

high

high

high

critical

high

high

high

high

high

critical