The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction.

The remote host is affected by the vulnerability described in GLSA-201001-03 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the     CVE identifiers referenced below and the associated PHP release notes     for details.
  Impact :

    A context-dependent attacker could execute arbitrary code via a     specially crafted string containing an HTML entity when the mbstring     extension is enabled. Furthermore a remote attacker could execute     arbitrary code via a specially crafted GD graphics file.
    A remote attacker could also cause a Denial of Service via a malformed     string passed to the json_decode() function, via a specially crafted     ZIP file passed to the php_zip_make_relative_path() function, via a     malformed JPEG image passed to the exif_read_data() function, or via     temporary file exhaustion. It is also possible for an attacker to spoof     certificates, bypass various safe_mode and open_basedir restrictions     when certain criteria are met, perform Cross-site scripting attacks,     more easily perform SQL injection attacks, manipulate settings of other     virtual hosts on the same server via a malicious .htaccess entry when     running on Apache, disclose memory portions, and write arbitrary files     via a specially crafted ZIP archive. Some vulnerabilities with unknown     impact and attack vectors have been reported as well.
  Workaround :

    There is no known workaround at this time.

This update fixes the JSON parser (CVE-2009-1271) and the zip packer code (CVE-2009-1272) in php5. Both bugs can lead to a remote denial of service attack.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.9.  Such versions may be affected by several security issues :

  - Background color is not correctly validated with a non-true color image in function 'imagerotate()'. (CVE-2008-5498)

  - A denial of service condition can be triggered by trying to extract zip files that contain files with relative paths in file or directory names.

  - Function 'explode()' is affected by an unspecified vulnerability.

  - It may be possible to trigger a segfault by passing a specially crafted string to function 'json_decode()'.

  - Function 'xml_error_string()' is affected by a flaw that results in messages being off by one." ); 

According to its banner, the version of PHP installed on the remote host is older than 5.2.9.  Such versions may be affected by several security issues :

  - Background color is not correctly validated with a non true     color image in function 'imagerotate()'. (CVE-2008-5498)

  - A denial of service condition can be triggered by trying to     extract zip files that contain files with relative paths     in file or directory names.

  - Function 'explode()' is affected by an unspecified     vulnerability.

  - It may be possible to trigger a segfault by passing a     specially crafted string to function 'json_decode()'.

  - Function 'xml_error_string()' is affected by a flaw     which results in messages being off by one.

ID	Name	Product	Family	Type	Severity
44892	GLSA-201001-03 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
41477	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6311)	Nessus	SuSE Local Security Checks	Local	medium
41369	SuSE 11 Security Update : PHP5 (SAT Patch Number 1015)	Nessus	SuSE Local Security Checks	Local	medium
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	Local	critical
4943	PHP 5.x < 5.2.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		high
35750	PHP < 5.2.9 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2009-1272

high

Tenable Plugins

critical

medium

medium

critical

high

medium