ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

The remote Solaris system is missing necessary patches to address security updates :

  - Session fixation vulnerability in the Sessions subsystem     in PHP before 5.5.2 allows remote attackers to hijack     web sessions by specifying a session ID. (CVE-2011-4718)

  - Unspecified vulnerability in the _php_stream_scandir     function in the stream implementation in PHP before     5.3.15 and 5.4.x before 5.4.5 has unknown impact and     remote attack vectors, related to an 'overflow.'     (CVE-2012-2688)

  - The SQLite functionality in PHP before 5.3.15 allows     remote attackers to bypass the open_basedir protection     mechanism via unspecified vectors. (CVE-2012-3365)

  - ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before     5.4.13 does not validate the relationship between the     soap.wsdl_cache_dir directive and the open_basedir     directive, which allows remote attackers to bypass     intended access restrictions by triggering the creation     of cached SOAP WSDL files in an arbitrary directory.
    (CVE-2013-1635)

  - The SOAP parser in PHP before 5.3.23 and 5.4.x before     5.4.13 allows remote attackers to read arbitrary files     via a SOAP WSDL file containing an XML external entity     declaration in conjunction with an entity reference,     related to an XML External Entity (XXE) issue in the     soap_xmlParseFile and soap_xmlParseMemory functions.
    NOTE: this vulnerability exists because of an incorrect     fix for CVE-2013-1824. (CVE-2013-1643)

  - Heap-based buffer overflow in the php_quot_print_encode     function in ext/ standard/quot_print.c in PHP before     5.3.26 and 5.4.x before 5.4.16 allows remote attackers     to cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     argument to the quoted_printable_encode function.
    (CVE-2013-2110)

  - ext/xml/xml.c in PHP before 5.3.27 does not properly     consider parsing depth, which allows remote attackers to     cause a denial of service (heap memory corruption) or     possibly have unspecified other impact via a crafted     document that is processed by the xml_parse_into_struct     function. (CVE-2013-4113)

  - The openssl_x509_parse function in openssl.c in the     OpenSSL module in PHP before 5.4.18 and 5.5.x before     5.5.2 does not properly handle a '\0' character in a     domain name in the Subject Alternative Name field of an     X.509 certificate, which allows man-in-the-middle     attackers to spoof arbitrary SSL servers via a crafted     certificate issued by a legitimate Certification     Authority, a related issue to CVE-2009-2408.
    (CVE-2013-4248)

  - Integer overflow in the SdnToJewish function in jewish.c     in the Calendar component in PHP before 5.3.26 and 5.4.x     before 5.4.16 allows context-dependent attackers to     cause a denial of service (application hang) via a large     argument to the jdtojewish function. (CVE-2013-4635)

  - The mget function in libmagic/softmagic.c in the     Fileinfo component in PHP 5.4.x before 5.4.16 allows     remote attackers to cause a denial of service (invalid     pointer dereference and application crash) via an MP3     file that triggers incorrect MIME type detection during     access to an finfo object. (CVE-2013-4636)

The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker can cause arbitrary code execution, create       a Denial of Service condition, read or write arbitrary files, impersonate       other servers, hijack a web session, or have other unspecified impact.
      Additionally, a local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

- fixing the following security issues :

  - CVE-2013-4635.patch (bnc#828020) :

  - Integer overflow in the SdnToJewish

  - CVE-2013-1635.patch and CVE-2013-1643.patch (bnc#807707) :

  - reading system files via untrusted SOAP input

  - soap.wsdl_cache_dir function did not honour PHP     open_basedir

  - CVE-2013-4113.patch (bnc#829207) :

  - heap corruption due to badly formed xml

The remote host is missing Mac OS X security update 2013-004 that fixes multiple security issues. 

The remote host is running a version of Mac OS X 10.8 that is older than 10.8.5. The newer version contains numerous security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

 This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

 Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied.  This update contains several security-related fixes for the following component :

  - Apache
  - Bind
  - Certificate Trust Policy
  - ClamAV
  - Installer
  - IPSec
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - QuickTime
  - sudo

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The following security issues have been fixed :

  - (bnc#828020):. (CVE-2013-4635)

  - Integer overflow in SdnToJewish()

  - (bnc#829207):. (CVE-2013-4113)

  - heap corruption due to badly formed xml

The following security issues have been fixed :

  - (bnc#828020):. (CVE-2013-4635)

  - Integer overflow in SdnToJewish()

  - (bnc#807707):. (CVE-2013-1635 / CVE-2013-1643)

  - reading system files via untrusted SOAP input

  - soap.wsdl_cache_dir function did not honour PHP     open_basedir

  - (bnc#829207):. (CVE-2013-4113)

  - heap corruption due to badly formed xml

The following security issues have been fixed :

  - (bnc#828020): o Integer overflow in SdnToJewish().
    (CVE-2013-4635)

  - (bnc#807707): o reading system files via untrusted SOAP     input o soap.wsdl_cache_dir function did not honour PHP     open_basedir. (CVE-2013-1635 / CVE-2013-1643)

  - (bnc#829207): o heap corruption due to badly formed xml.
    (CVE-2013-4113)

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.13.  It is, therefore, potentially affected by an information disclosure vulnerability. The 5.4.12 fix for CVE-2013-1635 / CVE-2013-1643 was incomplete and an error still exists in the files 'ext/soap/php_xml.c' and 'ext/libxml/libxml.c' related to handling external entities.  This error could cause PHP to parse remote XML documents defined by an attacker and could allow access to arbitraryfiles.

Note that this plugin does not attempt to exploit the vulnerability, but instead relies only on PHP's self-reported version number.

According to its banner, the version of PHP 5.3.x installed on the remote host is prior to 5.3.23.  It is, therefore, potentially affected by multiple vulnerabilities:

  - An error exists in the file 'ext/soap/soap.c'     related to the 'soap.wsdl_cache_dir' configuration     directive and writing cache files that could allow     remote 'wsdl' files to be written to arbitrary     locations. (CVE-2013-1635)

  - An error exists in the file 'ext/soap/php_xml.c'     related to parsing SOAP 'wsdl' files and external     entities that could cause PHP to parse remote XML     documents defined by an attacker. This could allow     access to arbitrary files. (CVE-2013-1643)

  - An information disclosure in the file     'ext/soap/php_xml.c' related to parsing SOAP 'wsdl'     files and external entities that could cause PHP to     parse remote XML documents defined by an attacker. This     could allow access to arbitrary files. (CVE-2013-1824)

Note that this plugin does not attempt to exploit the vulnerability, but instead relies only on PHP's self-reported version number.

Multiple vulnerabilities has been discovered and corrected in php :

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory (CVE-2013-1635).

The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions (CVE-2013-1643).

Backported upstream php bug #61930: 'openssl corrupts ssl key resource when using openssl_get_publickey\(\)' to php-5.3.x.

The new Powered by Mageia logo has been added to php, this is only a cosmetic change.

The php-timezonedb package has been updated to the 2013.2 version.

The updated packages have been upgraded to the 5.3.23 version which is not vulnerable to these issues.

Additionally, some packages which requires so has been rebuilt for php-5.3.23.

Upstream NEWS, 14 Mar 2012, PHP 5.4.13

Core :

  - Fixed bug #64235 (Insteadof not work for class method in     5.4.11). (Laruence)

    - Implemented FR #64175 (Added HTTP codes as of RFC       6585). (Jonh Wendell)

    - Fixed bug #64142 (dval to lval different behavior on       ppc64). (Remi)

    - Fixed bug #64070 (Inheritance with Traits failed with       error). (Dmitry)

CLI server :

  - Fixed bug #64128 (buit-in web server is broken on     ppc64). (Remi)

Mbstring :

  - mb_split() can now handle empty matches like     preg_split() does. (Moriyoshi)

OpenSSL :

  - Fixed bug #61930 (openssl corrupts ssl key resource when     using openssl_get_publickey()). (Stas)

PDO_mysql :

  - Fixed bug #60840 (undefined symbol:
    mysqlnd_debug_std_no_trace_funcs). (Johannes)

Phar :

  - Fixed timestamp update on Phar contents modification.
    (Dmitry)

SOAP :

  - Added check that soap.wsdl_cache_dir conforms to     open_basedir (CVE-2013-1635). (Dmitry)

    - Disabled external entities loading (CVE-2013-1643).
      (Dmitry)

SPL :

  - Fixed bug #64264 (SPLFixedArray toArray problem).
    (Laruence)

    - Fixed bug #64228 (RecursiveDirectoryIterator always       assumes SKIP_DOTS). (patch by kriss at krizalys.com,       Laruence)

    - Fixed bug #64106 (Segfault on SplFixedArray[][x] = y       when extended). (Nikita Popov)

    - Fixed bug #52861 (unset fails with ArrayObject and       deep arrays). (Mike Willbanks)

SNMP :

  - Fixed bug #64124 (IPv6 malformed). (Boris Lytochkin)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New php packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

The PHP development team reports :

PHP does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

The SOAP parser in PHP allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.

Several vulnerabilities have been discovered in PHP, the web scripting language. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2013-1635     If a PHP application accepted untrusted SOAP object     input remotely from clients, an attacker could read     system files readable for the webserver.

  - CVE-2013-1643     The soap.wsdl_cache_dir function did not take PHP     open_basedir restrictions into account. Note that Debian     advises against relying on open_basedir restrictions for     security.

PHP versions 5.4.x earlier than 5.4.12 are affected by the following vulnerabilities :

  - An error exists in the file 'ext/soap/soap.c' related to the 'soap.wsdl_cache_dir' configuration directive and writing cache files that could allow remote 'wsdl' files to be written to arbitrary locations. (CVE-2013-1635)

  - An error exists in the file 'ext/soap/php_xml.c' related to parsing SOAP 'wsdl' files and external entities that could cause PHP to parse remote XML documents defined by an attacker. This could allow access to arbitrary files. (CVE-2013-1643)

PHP versions 5.3.x earlier than 5.3.22 are affected by the following vulnerabilities :

  - An error exists in the file 'ext/soap/soap.c' related to the 'soap.wsdl_cache_dir' configuration directive and writing cache files that could allow remote 'wsdl' files to be written to arbitrary locations. (CVE-2013-1635)

  - An error exists in the file 'ext/soap/php_xml.c' related to parsing SOAP 'wsdl' files and external entities that could cause PHP to parse remote XML documents defined by an attacker. This could allow access to arbitrary files. (CVE-2013-1643)

According to its banner, the version of PHP 5.3.x installed on the remote host is prior to 5.3.22.  It is, therefore, potentially affected by the following vulnerabilities :

  - An error exists in the file 'ext/soap/soap.c'     related to the 'soap.wsdl_cache_dir' configuration     directive and writing cache files that could allow     remote 'wsdl' files to be written to arbitrary     locations. (CVE-2013-1635)

  - An error exists in the file 'ext/soap/php_xml.c'     related to parsing SOAP 'wsdl' files and external     entities that could cause PHP to parse remote XML     documents defined by an attacker. This could allow     access to arbitrary files. (CVE-2013-1643)

Note that this plugin does not attempt to exploit the vulnerabilities but, instead relies only on PHP's self-reported version number.

Multiple vulnerabilities has been discovered and corrected in php :

PHP does not validate the configration directive soap.wsdl_cache_dir before writing SOAP wsdl cache files to the filesystem. Thus an attacker is able to write remote wsdl files to arbitrary locations (CVE-2013-1635).

PHP allows the use of external entities while parsing SOAP wsdl files which allows an attacker to read arbitrary files. If a web application unserializes user-supplied data and tries to execute any method of it, an attacker can send serialized SoapClient object initialized in non-wsdl mode which will make PHP to parse automatically remote XML-document specified in the location option parameter (CVE-2013-1643).

The updated packages have been upgraded to the 5.3.22 version which is not vulnerable to these issues.

Additionally, some packages which requires so has been rebuilt for php-5.3.22.

ID	Name	Product	Family	Severity
80736	Oracle Solaris Third-Party Patch Update : php (cve_2013_4113_buffer_errors)	Nessus	Solaris Local Security Checks	critical
77455	GLSA-201408-11 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75096	openSUSE Security Update : php5 (openSUSE-SU-2013:1244-1)	Nessus	SuSE Local Security Checks	high
8008	Mac OS X 10.8 < 10.8.5 Multiple Vulnerabilities (Security Update 2013-004)	Nessus Network Monitor	Web Clients	critical
69878	Mac OS X Multiple Vulnerabilities (Security Update 2013-004)	Nessus	MacOS X Local Security Checks	critical
69877	Mac OS X 10.8.x < 10.8.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
69296	SuSE 11.2 / 11.3 Security Update : PHP5 (SAT Patch Numbers 8087 / 8088)	Nessus	SuSE Local Security Checks	high
69295	SuSE 11.2 / 11.3 Security Update : PHP5 (SAT Patch Numbers 8087 / 8088)	Nessus	SuSE Local Security Checks	high
69294	SuSE 11.2 Security Update : PHP5 (SAT Patch Number 8086)	Nessus	SuSE Local Security Checks	high
69172	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 8647)	Nessus	SuSE Local Security Checks	high
66585	PHP 5.4.x < 5.4.13 Information Disclosure	Nessus	CGI abuses	high
66584	PHP 5.3.x < 5.3.23 Multiple Vulnerabilities	Nessus	CGI abuses	high
66126	Mandriva Linux Security Advisory : php (MDVSA-2013:114)	Nessus	Mandriva Local Security Checks	high
65774	Fedora 17 : php-5.4.13-1.fc17 (2013-3927)	Nessus	Fedora Local Security Checks	high
65773	Fedora 18 : php-5.4.13-1.fc18 (2013-3891)	Nessus	Fedora Local Security Checks	high
65660	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : php (SSA:2013-081-01)	Nessus	Slackware Local Security Checks	high
65623	FreeBSD : php5 -- Multiple vulnerabilities (1d23109a-9005-11e2-9602-d43d7e0c7c02)	Nessus	FreeBSD Local Security Checks	high
65033	Debian DSA-2639-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
6708	PHP 5.4.x < 5.4.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
6707	PHP 5.3.x < 5.3.22 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
64992	PHP 5.3.x < 5.3.22 Multiple Vulnerabilities	Nessus	CGI abuses	high
64942	Mandriva Linux Security Advisory : php (MDVSA-2013:016)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2013-1635

critical

Tenable Plugins

critical

high

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

high

high