The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.

Versions of PHP 5.3.x prior to 5.3.14, or 5.4.x prior to 5.4.4 are affected by the following vulnerabilities :

 - An integer overflow error exists in the function 'phar_parse_tarfile' in the file 'ext/phar/tar.c'. This error can lead to a heap-based buffer overflow when handling a maliciously crafted TAR file. Arbitrary code execution is possible due to this error. (CVE-2012-2386)
 - A weakness exists in the 'crypt' function related to the DES implementation that can allow brute-force attacks. (CVE-2012-2143)
 - Several design errors exist involving the incorrect parsing of PHP PDO prepared statements could lead to disclosure of sensitive information or denial of service. (CVE-2012-3450)
 - A variable initialization error exists in the file 'ext/openssl/openssl.c' that can allow process memory contents to be disclosed when input data is of length zero. (CVE-2012-6113)

It was discovered that PHP incorrectly handled the openssl_encrypt function when used with an empty string. An attacker could use this flaw to cause PHP to disclose arbitrary memory contents and possibly expose sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP installed on the remote host is 5.3.x earlier than 5.3.14, and is, therefore, potentially affected the following vulnerabilities :

  - An integer overflow error exists in the function     'phar_parse_tarfile' in the file 'ext/phar/tar.c'. This     error can lead to a heap-based buffer overflow when     handling a maliciously crafted TAR file. Arbitrary code     execution is possible due to this error. (CVE-2012-2386)

  - A weakness exists in the 'crypt' function related to     the DES implementation that can allow brute-force     attacks. (CVE-2012-2143)

  - Several design errors involving the incorrect parsing     of PHP PDO prepared statements could lead to disclosure     of sensitive information or denial of service.
    (CVE-2012-3450)

  - A variable initialization error exists in the file     'ext/openssl/openssl.c' that can allow process memory     contents to be disclosed when input data is of length     zero. (CVE-2012-6113)

ID	Name	Product	Family	Severity
9097	PHP 5.3.x < 5.3.14 / 5.4.x < 5.4.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
63667	Ubuntu 12.04 LTS : php5 vulnerability (USN-1702-1)	Nessus	Ubuntu Local Security Checks	medium
59529	PHP 5.3.x < 5.3.14 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2012-6113

high

Tenable Plugins

high

medium

high