Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is a version prior to 7.2.1.0. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability, known as BEAST,     exists in the SSL 3.0 and TLS 1.0 protocols due to a     flaw in the way the initialization vector (IV) is     selected when operating in cipher-block chaining (CBC)     modes. A man-in-the-middle attacker can exploit this     to obtain plaintext HTTP header data, by using a     blockwise chosen-boundary attack (BCBA) on an HTTPS     session, in conjunction with JavaScript code that uses     the HTML5 WebSocket API, the Java URLConnection API,     or the Silverlight WebClient API. (CVE-2011-3389)

  - The utility 'apachectl' can receive a zero-length     directory name in the LD_LIBRARY_PATH via the 'envvars'     file. A local attacker with access to that utility     could exploit this to load a malicious Dynamic Shared     Object (DSO), leading to arbitrary code execution.
    (CVE-2012-0883)

  - Numerous, unspecified errors could allow remote denial     of service attacks. (CVE-2012-2110, CVE-2012-2329,     CVE-2012-2336, CVE-2013-2357, CVE-2013-2358,     CVE-2013-2359, CVE-2013-2360)

  - The fix for CVE-2012-1823 does not completely correct     the CGI query parameter vulnerability. Disclosure of     PHP source code and code execution are still possible.
    Note that this vulnerability is exploitable only when     PHP is used in CGI-based configurations.  Apache with     'mod_php' is not an exploitable configuration.
    (CVE-2012-2311, CVE-2012-2335)

  - Unspecified errors exist that could allow unauthorized     access. (CVE-2012-5217, CVE-2013-2355)

  - Unspecified errors exist that could allow disclosure of     sensitive information. (CVE-2013-2356, CVE-2013-2363)

  - An unspecified error exists that could allow cross-site     scripting attacks. (CVE-2013-2361)

  - Unspecified errors exist that could allow a local     attacker to cause denial of service conditions.
    (CVE-2013-2362, CVE-2013-2364)

  - An as-yet unspecified vulnerability exists that could     cause a denial of service condition. (CVE-2013-4821)

PHP versions earlier than 5.4.3 are affected by the following vulnerabilities.

  - The fix for CVE-2012-1823 does not completely correct the CGI query parameter vulnerability. Disclosure of PHP source code and code execution via query paramenters are still possible. Note that his vulnerability is exploitable only when PHP is used by CGI-based configurations. Apache with 'mod-php' is not an exploitable configuration. (CVE-2012-2311, CVE-2012-2335, CVE-2012-2336)

  - An unspecified buffer overflow exists related to the function 'apache_request_headers'. (CVE-2012-2329)

Versions of PHP 5.4.x prior to 5.4.3 are affected by the following vulnerabilities :

 - The fix for CVE-2012-1823 does not completely correct the CGI query parameter vulnerability. Disclosure of PHP source code and code execution via query paramenters are still possible. Note that his vulnerability is exploitable only when PHP is used by CGI-based configurations. Apache with 'mod-php' is not an exploitable configuration. (CVE-2012-2311, CVE-2012-2335, CVE-2012-2336)
 - An unspecified buffer overflow exists related to the function 'apache_request_headers'. (CVE-2012-2329)
 - An arbitrary code execution vulnerability which affects the function 'com_event_sink()' when processing a specially crafted COM object.

The PHP Development Team reports :

The release of PHP 5.4.13 and 5.4.3 complete a fix for the vulnerability in CGI-based setups as originally described in CVE-2012-1823. (CVE-2012-2311)

Note: mod_php and php-fpm are not vulnerable to this attack.

PHP 5.4.3 fixes a buffer overflow vulnerability in the apache_request_headers() (CVE-2012-2329).

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.3. It is, therefore, potentially affected the following vulnerabilities : 

  - The fix for CVE-2012-1823 does not completely correct     the CGI query parameter vulnerability. Disclosure of     PHP source code and code execution are still possible.
    Note that this vulnerability is exploitable only when     PHP is used in CGI-based configurations.  Apache with     'mod_php' is not an exploitable configuration.
    (CVE-2012-2311, CVE-2012-2335, CVE-2012-2336)

  - An unspecified buffer overflow exists related to the     function 'apache_request_headers'. (CVE-2012-2329)

ID	Name	Product	Family	Severity
69020	HP System Management Homepage < 7.2.1.0 Multiple Vulnerabilities (BEAST)	Nessus	Web Servers	high
801071	PHP 5.3.x < 5.4.3 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
6495	PHP 5.4.x < 5.4.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
59084	FreeBSD : php -- multiple vulnerabilities (59b68b1e-9c78-11e1-b5e0-000c299b62e1)	Nessus	FreeBSD Local Security Checks	high
59057	PHP 5.4.x < 5.4.3 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2012-2329

high

Tenable Plugins

high

high

high

high

high