pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.

Versions of PHP 5.3.x prior to 5.3.14, or 5.4.x prior to 5.4.4 are affected by the following vulnerabilities :

 - An integer overflow error exists in the function 'phar_parse_tarfile' in the file 'ext/phar/tar.c'. This error can lead to a heap-based buffer overflow when handling a maliciously crafted TAR file. Arbitrary code execution is possible due to this error. (CVE-2012-2386)
 - A weakness exists in the 'crypt' function related to the DES implementation that can allow brute-force attacks. (CVE-2012-2143)
 - Several design errors exist involving the incorrect parsing of PHP PDO prepared statements could lead to disclosure of sensitive information or denial of service. (CVE-2012-3450)
 - A variable initialization error exists in the file 'ext/openssl/openssl.c' that can allow process memory contents to be disclosed when input data is of length zero. (CVE-2012-6113)

Three security bugs have been fixed in PHP5.

  - php5: potential overflow in _php_stream_scandir.
    (CVE-2012-2688)

  - open_basedir bypass via SQLite extension.
    (CVE-2012-3365)

  - An out of band read sql denial of service has been fixed     (bnc#769785). (CVE-2012-3450)

The remote host is affected by the vulnerability described in GLSA-201209-03 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code with the privileges of       the process, cause a Denial of Service condition, obtain sensitive       information, create arbitrary files, conduct directory traversal attacks,       bypass protection mechanisms, or perform further attacks with unspecified       impact.
  Workaround :

    There is no known workaround at this time.

It was discovered that PHP incorrectly handled certain character sequences when applying HTTP response-splitting protection. A remote attacker could create a specially crafted URL and inject arbitrary headers. (CVE-2011-1398, CVE-2012-4388)

It was discovered that PHP incorrectly handled directories with a large number of files. This could allow a remote attacker to execute arbitrary code with the privileges of the web server, or to perform a denial of service. (CVE-2012-2688)

It was discovered that PHP incorrectly parsed certain PDO prepared statements. A remote attacker could use this flaw to cause PHP to crash, leading to a denial of service. (CVE-2012-3450).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in php :

Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an overflow (CVE-2012-2688).

The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors (CVE-2012-3365).

pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value (CVE-2012-3450).

The updated packages have been upgraded to the 5.3.15 version which is not vulnerable to these issues.

Additionally the php-timezonedb packages has been upgraded to the latest version as well.

Several vulnerabilities have been discovered in PHP, the web scripting language. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2012-2688     A buffer overflow in the scandir() function could lead     to denial of service or the execution of arbitrary code.

  - CVE-2012-3450     It was discovered that inconsistent parsing of PDO     prepared statements could lead to denial of service.

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.4, and as such is potentially affected the following vulnerabilities :

  - An integer overflow error exists in the function     'phar_parse_tarfile' in the file 'ext/phar/tar.c'. This     error can lead to a heap-based buffer overflow when     handling a maliciously crafted TAR files. Arbitrary code     execution is possible due to this error. (CVE-2012-2386)

  - A weakness exists in the 'crypt' function related to     the DES implementation that can allow brute-force     attacks. (CVE-2012-2143)

  - Several design errors involving the incorrect parsing     of PHP PDO prepared statements could lead to disclosure     of sensitive information or denial of service.
    (CVE-2012-3450)

According to its banner, the version of PHP installed on the remote host is 5.3.x earlier than 5.3.14, and is, therefore, potentially affected the following vulnerabilities :

  - An integer overflow error exists in the function     'phar_parse_tarfile' in the file 'ext/phar/tar.c'. This     error can lead to a heap-based buffer overflow when     handling a maliciously crafted TAR file. Arbitrary code     execution is possible due to this error. (CVE-2012-2386)

  - A weakness exists in the 'crypt' function related to     the DES implementation that can allow brute-force     attacks. (CVE-2012-2143)

  - Several design errors involving the incorrect parsing     of PHP PDO prepared statements could lead to disclosure     of sensitive information or denial of service.
    (CVE-2012-3450)

  - A variable initialization error exists in the file     'ext/openssl/openssl.c' that can allow process memory     contents to be disclosed when input data is of length     zero. (CVE-2012-6113)

ID	Name	Product	Family	Severity
9097	PHP 5.3.x < 5.3.14 / 5.4.x < 5.4.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
64106	SuSE 11.2 Security Update : PHP5 (SAT Patch Number 6634)	Nessus	SuSE Local Security Checks	critical
64105	SuSE 11.2 Security Update : PHP5 (SAT Patch Number 6634)	Nessus	SuSE Local Security Checks	critical
62236	GLSA-201209-03 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
62178	Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : php5 vulnerabilities (USN-1569-1)	Nessus	Ubuntu Local Security Checks	critical
61961	Mandriva Linux Security Advisory : php (MDVSA-2012:108)	Nessus	Mandriva Local Security Checks	critical
61520	Debian DSA-2527-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
59530	PHP 5.4.x < 5.4.4 Multiple Vulnerabilities	Nessus	CGI abuses	high
59529	PHP 5.3.x < 5.3.14 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2012-3450

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

high

high