The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398.

PHP versions 5.4.x earlier than 5.4.1 are affected by the following vulnerabilities : 

  - The '$_FILES' variable can be corrupted because the names of uploaded files are not properly validated. (CVE-2012-1172)

  - The 'open_basedir' directive is not properly handled by the functions 'readline_write_history' and 'readline_read_history'.

  - It's possible to bypass an HTTP response-splitting protection because the 'sapi_header_op()' function in main/SAPI.c does not properly determine a pointer during checks for encoded carriage return characters. (Bug #60227 / CVE-2012-4388)

It was discovered that PHP incorrectly handled certain character sequences when applying HTTP response-splitting protection. A remote attacker could create a specially crafted URL and inject arbitrary headers. (CVE-2011-1398, CVE-2012-4388)

It was discovered that PHP incorrectly handled directories with a large number of files. This could allow a remote attacker to execute arbitrary code with the privileges of the web server, or to perform a denial of service. (CVE-2012-2688)

It was discovered that PHP incorrectly parsed certain PDO prepared statements. A remote attacker could use this flaw to cause PHP to crash, leading to a denial of service. (CVE-2012-3450).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.1, and, therefore, potentially affected by multiple vulnerabilities :

  - The '$_FILES' variable can be corrupted because the     names of uploaded files are not properly validated.
    (CVE-2012-1172)

  - The 'open_basedir' directive is not properly handled by     the functions 'readline_write_history' and     'readline_read_history'.

  - It's possible to bypass an HTTP response-splitting     protection because the 'sapi_header_op()' function in     main/SAPI.c does not properly determine a pointer during     checks for encoded carriage return characters. (Bug     #60227 / CVE-2012-4388)

ID	Name	Product	Family	Severity
6994	PHP 5.4.x < 5.4.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
62178	Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : php5 vulnerabilities (USN-1569-1)	Nessus	Ubuntu Local Security Checks	critical
58967	PHP 5.4.x < 5.4.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2012-4388

high

Tenable Plugins

medium

critical

medium