The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable.

The remote host is running HP System Management Homepage (HPSMH), a web-based interface for managing individual ProLiant and Integrity servers.

Versions of HP System Management Homepage earlier than 6.2 are potentially affected by the following vulnerabilities :

  - Session renegotiations are not handled properly, which could be exploited to insert arbitrary plaintext in a man-in-the-middle attack. (CVE-2009-3555)

  - An attacker may be able to upload files using a POST request with 'multipart/form-data' content even if the target script doesn't actually support file uploads per se. (CVE-2009-4017)

  - PHP's 'proc_open' function can be abused to bypass 'safe_mode_allowed_env_vars' and 'safe_mode_protected_env_vars' directives. (CVE-2009-4018)

  - PHP does not properly protect session data as relates to interrupt corruption of '$_SESSION' and the 'session.save_path' directive. (CVE-2009-4143)

  - An information disclosure vulnerability exists in Apache's mod_proxy_ajp, mod_reqtimeout, and mod_proxy_http relating to timeout conditions.  Note that this issue only affects HPSMH on Windows. (CVE-2010-2068)

  - An as-yet unspecified information disclosure vulnerability may allow an authorized user to gain access to sensitive information, which in turn could be leveraged to obtain root access on Linux installs of HPSMH. (CVE-2010-3009)

  - There is an as-yet unspecified XSS issue. (CVE-2010-3011)

  - There is an as-yet unspecified HTTP response splitting issue. (CVE-2010-3011)

According to its self-reported version number, the HP System Management Homepage install on the remote host is earlier than 6.2.
Such versions are reportedly affected by the following vulnerabilities :

  - Session renegotiations are not handled properly, which     could be exploited to insert arbitrary plaintext in a     man-in-the-middle attack. (CVE-2009-3555)

  - An attacker may be able to upload files using a POST     request with 'multipart/form-data' content even if the     target script doesn't actually support file uploads per     se. (CVE-2009-4017)

  - PHP's 'proc_open' function can be abused to bypass     'safe_mode_allowed_env_vars' and     'safe_mode_protected_env_vars' directives.
    (CVE-2009-4018)

  - PHP does not properly protect session data as relates     to interrupt corruption of '$_SESSION' and the     'session.save_path' directive. (CVE-2009-4143)

  - The application allows arbitrary URL redirections.
    (CVE-2010-1586 and CVE-2010-3283)

  - An information disclosure vulnerability exists in     Apache's mod_proxy_ajp, mod_reqtimeout, and     mod_proxy_http relating to timeout conditions. Note     that this issue only affects SMH on Windows.
    (CVE-2010-2068)

  - An as-yet unspecified information disclosure     vulnerability may allow an authorized user to gain     access to sensitive information, which in turn could     be leveraged to obtain root access on Linux installs     of SMH. (CVE-2010-3009)

  - There is an as-yet unspecified HTTP response splitting     issue. (CVE-2010-3011)

  - There is an as-yet unspecified cross-site scripting     issue. (CVE-2010-3012)

  - An as-yet unspecified vulnerability could lead to     remote disclosure of sensitive information.
    (CVE-2010-3284)

Some vulnerabilities were discovered and corrected in php-5.2.11 :

The tempnam function in ext/standard/file.c in PHP 5.2.11 and earlier, and 5.3.x before 5.3.1, allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments (CVE-2009-3557).

The posix_mkfifo function in ext/posix/posix.c in PHP 5.2.11 and earlier, and 5.3.x before 5.3.1, allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file (CVE-2009-3558).

PHP 5.2.11, and 5.3.x before 5.3.1, does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive (CVE-2009-4017).

The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable (CVE-2009-4018).

Intermittent segfaults occured on x86_64 with the latest phpmyadmin and with apache (#53735).

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

Multiple vulnerabilities was discovered and corrected in php :

The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file (CVE-2008-7068).

The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function (CVE-2009-1271).

  - Fixed upstream bug #48378 (exif_read_data() segfaults on     certain corrupted .jpeg files) (CVE-2009-2687).

The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates (CVE-2009-3291).

Unspecified vulnerability in PHP before 5.2.11 has unknown impact and attack vectors related to missing sanity checks around exif processing. (CVE-2009-3292)

Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an incorrect sanity check for the color index. (CVE-2009-3293)

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.0, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third-party information (CVE-2009-3546).

The tempnam function in ext/standard/file.c in PHP 5.2.11 and earlier, and 5.3.x before 5.3.1, allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments (CVE-2009-3557).

The posix_mkfifo function in ext/posix/posix.c in PHP 5.2.11 and earlier, and 5.3.x before 5.3.1, allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file (CVE-2009-3558).

PHP 5.2.11, and 5.3.x before 5.3.1, does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive (CVE-2009-4017).

The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable (CVE-2009-4018).

The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file (CVE-2008-7068).

The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates (CVE-2009-3291).

Unspecified vulnerability in PHP before 5.2.11 has unknown impact and attack vectors related to missing sanity checks around exif processing. (CVE-2009-3292)

Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an incorrect sanity check for the color index. (CVE-2009-3293). However in Mandriva we don't use the bundled libgd source in php per default, there is a unsupported package in contrib named php-gd-bundled that eventually will get updated to pickup these fixes.

The php-suhosin package has been upgraded to 0.9.22 which has better support for apache vhosts.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides a solution to these vulnerabilities.

Maksymilian Arciemowicz discovered that PHP did not properly validate arguments to the dba_replace function. If a script passed untrusted input to the dba_replace function, an attacker could truncate the database. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, and 8.10. (CVE-2008-7068)

It was discovered that PHP's php_openssl_apply_verification_policy function did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2009-3291)

It was discovered that PHP did not properly handle certain malformed images when being parsed by the Exif module. A remote attacker could exploit this flaw and cause the PHP server to crash, resulting in a denial of service. (CVE-2009-3292)

Grzegorz Stachowiak discovered that PHP did not properly enforce restrictions in the tempnam function. An attacker could exploit this issue to bypass safe_mode restrictions. (CVE-2009-3557)

Grzegorz Stachowiak discovered that PHP did not properly enforce restrictions in the posix_mkfifo function. An attacker could exploit this issue to bypass open_basedir restrictions. (CVE-2009-3558)

Bogdan Calin discovered that PHP did not limit the number of temporary files created when handling multipart/form-data POST requests. A remote attacker could exploit this flaw and cause the PHP server to consume all available resources, resulting in a denial of service.
(CVE-2009-4017)

ATTENTION: This update changes previous PHP behaviour by limiting the number of files in a POST request to 50. This may be increased by adding a 'max_file_uploads' directive to the php.ini configuration file.

It was discovered that PHP did not properly enforce restrictions in the proc_open function. An attacker could exploit this issue to bypass safe_mode_protected_env_vars restrictions and possibly execute arbitrary code with application privileges. (CVE-2009-4018).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Some vulnerabilities were discovered and corrected in php :

PHP 5.2.11, and 5.3.x before 5.3.1, does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive (CVE-2009-4017).

The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable (CVE-2009-4018).

The updated packages have been patched to correct these issues.

According to its banner, the version of PHP 5.3.x installed on the remote host is earlier than 5.3.1.  Such versions are potentially affected by multiple issues : 

  - Sanity checks are missing in exif processing.

  - It is possible to bypass the 'safe_mode' configuration setting using 'tempnam()'.

  - It is possible to bypass the 'open_basedir' configuration setting using 'posix_mkfifo()'.

  - The 'safe_mode_include_dir' configuration setting may be ignored.

  - Calling 'popen()' with an invalid mode can cause a crash.

  - A safe_mode restriction-bypass vulnerability because environment variables specified for 'proc_open' are passed without checking them.

According to its banner, the version of PHP 5.3 installed on the remote host is older than 5.3.1.  Such versions may be affected by several security issues :

  - Sanity checks are missing in exif processing.

  - It is possible to bypass the 'safe_mode' configuration     setting using 'tempnam()'.

  - It is possible to bypass the 'open_basedir'     configuration setting using 'posix_mkfifo()'.

  - The 'safe_mode_include_dir' configuration setting may     be ignored. (Bug #50063)

  - Calling 'popen()' with an invalid mode can cause a     crash under Windows. (Bug #44683)

  - Provided file uploading is enabled (it is by default),     an attacker can upload files using a POST request with     'multipart/form-data' content even if the target script     doesn't actually support file uploads per se. By     supplying a large number (15,000+) of files, an attacker     could cause the web server to stop responding while it     processes the file list.

  - 'proc_open()' can bypass 'safe_mode_protected_env_vars'.
    (Bug #49026)

  - An unspecified vulnerability affects the LCG entropy.

According to its banner, the version of PHP installed on the remote host is earlier than 5.2.11.  Such versions are reportedly affected by multiple issues : 

  - An unspecified error occurs in certificate validation inside 'php_openssl_apply_verification_policy'.
  - An unspecified input validation vulnerability affects the color index in 'imagecolortransparent()'.
  - A denial-of-service vulnerability related to 'popen' when invalid modes are used. (Bug 44683)

According to its banner, the version of PHP installed on the remote host is older than 5.2.11.  Such versions may be affected by several security issues :

  - An unspecified error occurs in certificate validation     inside 'php_openssl_apply_verification_policy'.

  - An unspecified input validation vulnerability affects     the color index in 'imagecolortransparent()'.

  - An unspecified input validation vulnerability affects     exif processing.

  - Calling 'popen()' with an invalid mode can cause a     crash under Windows. (Bug #44683)

  - An integer overflow in 'xml_utf8_decode()' can make it     easier to bypass cross-site scripting and SQL injection     protection mechanisms using a specially crafted string     with a long UTF-8 encoding. (Bug #49687)

  - 'proc_open()' can bypass 'safe_mode_protected_env_vars'.
    (Bug #49026)

ID	Name	Product	Family	Severity
5667	HP System Management Homepage < 6.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
49272	HP System Management Homepage < 6.2 Multiple Vulnerabilities	Nessus	Web Servers	high
48159	Mandriva Linux Security Advisory : php (MDVSA-2009:303)	Nessus	Mandriva Local Security Checks	high
43043	Mandriva Linux Security Advisory : php (MDVSA-2009:324)	Nessus	Mandriva Local Security Checks	high
42930	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : php5 vulnerabilities (USN-862-1)	Nessus	Ubuntu Local Security Checks	high
42918	Mandriva Linux Security Advisory : php (MDVSA-2009:304)	Nessus	Mandriva Local Security Checks	high
801090	PHP 5.3.x < 5.3.1 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	medium
5242	PHP 5.3.x < 5.3.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
42862	PHP 5.3 < 5.3.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
5178	PHP < 5.2.11 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
41014	PHP < 5.2.11 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2009-4018

critical

Tenable Plugins

high

high

high

high

high

high

medium

high

medium

high

high