Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.

The following security issues have been fixed :

  - CVE-2013-4635 (bnc#828020):
  - Integer overflow in SdnToJewish()

  - CVE-2013-4113 (bnc#829207):
  - heap corruption due to badly formed xml

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Solaris system is missing necessary patches to address security updates :

  - Session fixation vulnerability in the Sessions subsystem     in PHP before 5.5.2 allows remote attackers to hijack     web sessions by specifying a session ID. (CVE-2011-4718)

  - Unspecified vulnerability in the _php_stream_scandir     function in the stream implementation in PHP before     5.3.15 and 5.4.x before 5.4.5 has unknown impact and     remote attack vectors, related to an 'overflow.'     (CVE-2012-2688)

  - The SQLite functionality in PHP before 5.3.15 allows     remote attackers to bypass the open_basedir protection     mechanism via unspecified vectors. (CVE-2012-3365)

  - ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before     5.4.13 does not validate the relationship between the     soap.wsdl_cache_dir directive and the open_basedir     directive, which allows remote attackers to bypass     intended access restrictions by triggering the creation     of cached SOAP WSDL files in an arbitrary directory.
    (CVE-2013-1635)

  - The SOAP parser in PHP before 5.3.23 and 5.4.x before     5.4.13 allows remote attackers to read arbitrary files     via a SOAP WSDL file containing an XML external entity     declaration in conjunction with an entity reference,     related to an XML External Entity (XXE) issue in the     soap_xmlParseFile and soap_xmlParseMemory functions.
    NOTE: this vulnerability exists because of an incorrect     fix for CVE-2013-1824. (CVE-2013-1643)

  - Heap-based buffer overflow in the php_quot_print_encode     function in ext/ standard/quot_print.c in PHP before     5.3.26 and 5.4.x before 5.4.16 allows remote attackers     to cause a denial of service (application crash) or     possibly have unspecified other impact via a crafted     argument to the quoted_printable_encode function.
    (CVE-2013-2110)

  - ext/xml/xml.c in PHP before 5.3.27 does not properly     consider parsing depth, which allows remote attackers to     cause a denial of service (heap memory corruption) or     possibly have unspecified other impact via a crafted     document that is processed by the xml_parse_into_struct     function. (CVE-2013-4113)

  - The openssl_x509_parse function in openssl.c in the     OpenSSL module in PHP before 5.4.18 and 5.5.x before     5.5.2 does not properly handle a '\0' character in a     domain name in the Subject Alternative Name field of an     X.509 certificate, which allows man-in-the-middle     attackers to spoof arbitrary SSL servers via a crafted     certificate issued by a legitimate Certification     Authority, a related issue to CVE-2009-2408.
    (CVE-2013-4248)

  - Integer overflow in the SdnToJewish function in jewish.c     in the Calendar component in PHP before 5.3.26 and 5.4.x     before 5.4.16 allows context-dependent attackers to     cause a denial of service (application hang) via a large     argument to the jdtojewish function. (CVE-2013-4635)

  - The mget function in libmagic/softmagic.c in the     Fileinfo component in PHP 5.4.x before 5.4.16 allows     remote attackers to cause a denial of service (invalid     pointer dereference and application crash) via an MP3     file that triggers incorrect MIME type detection during     access to an finfo object. (CVE-2013-4636)

The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker can cause arbitrary code execution, create       a Denial of Service condition, read or write arbitrary files, impersonate       other servers, hijack a web session, or have other unspecified impact.
      Additionally, a local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

- fixing the following security issues :

  - CVE-2013-4635.patch (bnc#828020) :

  - Integer overflow in the SdnToJewish

  - CVE-2013-1635.patch and CVE-2013-1643.patch (bnc#807707) :

  - reading system files via untrusted SOAP input

  - soap.wsdl_cache_dir function did not honour PHP     open_basedir

  - CVE-2013-4113.patch (bnc#829207) :

  - heap corruption due to badly formed xml

The following security issues have been fixed :

  - (bnc#828020):. (CVE-2013-4635)

  - Integer overflow in SdnToJewish()

  - (bnc#829207):. (CVE-2013-4113)

  - heap corruption due to badly formed xml

The following security issues have been fixed :

  - (bnc#828020):. (CVE-2013-4635)

  - Integer overflow in SdnToJewish()

  - (bnc#807707):. (CVE-2013-1635 / CVE-2013-1643)

  - reading system files via untrusted SOAP input

  - soap.wsdl_cache_dir function did not honour PHP     open_basedir

  - (bnc#829207):. (CVE-2013-4113)

  - heap corruption due to badly formed xml

The following security issues have been fixed :

  - (bnc#828020): o Integer overflow in SdnToJewish().
    (CVE-2013-4635)

  - (bnc#807707): o reading system files via untrusted SOAP     input o soap.wsdl_cache_dir function did not honour PHP     open_basedir. (CVE-2013-1635 / CVE-2013-1643)

  - (bnc#829207): o heap corruption due to badly formed xml.
    (CVE-2013-4113)

It was discovered that PHP incorrectly handled the xml_parse_into_struct function. If a PHP application parsed untrusted XML, an attacker could use this flaw with a specially crafted XML document to cause PHP to crash, resulting in a denial of service, or to possibly execute arbitrary code. (CVE-2013-4113)

It was discovered that PHP incorrectly handled the jdtojewish function. An attacker could use this flaw to cause PHP to crash, resulting in a denial of service. (CVE-2013-4635).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PHP development team reports :

Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.

PHP versions earlier than 5.4.16 and 5.3.26 are affected by a heap based buffer overflow vulnerability due to lack of user input sanitation when parsing strings. (An additional security vulnerability exists while parsing 'mimetype' for MP3 files, which can be exploited to cause a crash in version 5.4.15.)

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.16.  It is, therefore, potentially affected by the following vulnerabilities:

  - An error exists in the mimetype detection of 'mp3' files     that could lead to a denial of service. (Bug #64830)

  - An error exists in the function 'php_quot_print_encode'     in the file 'ext/standard/quot_print.c' that could allow     a heap-based buffer overflow when attempting to parse     certain strings. (Bug #64879)

  - An integer overflow error exists related to the value     of 'JEWISH_SDN_MAX' in the file 'ext/calendar/jewish.c'     that could allow denial of service attacks. (Bug #64895)

Note that this plugin does not attempt to exploit these vulnerabilities, but instead relies only on PHP's self-reported version number.

According to its banner, the version of PHP 5.3.x installed on the remote host is prior to 5.3.26.  It is, therefore, potentially affected by the following vulnerabilities:

  - An error exists in the function 'php_quot_print_encode'     in the file 'ext/standard/quot_print.c' that could allow     a heap-based buffer overflow when attempting to parse     certain strings (Bug #64879)

  - An integer overflow error exists related to the value     of 'JEWISH_SDN_MAX' in the file 'ext/calendar/jewish.c'     that could allow denial of service attacks. (Bug #64895)

Note that this plugin does not attempt to exploit these vulnerabilities, but instead relies only on PHP's self-reported version number.

ID	Name	Product	Family	Severity
83598	SUSE SLES11 Security Update : PHP5 (SUSE-SU-2013:1316-1)	Nessus	SuSE Local Security Checks	medium
80736	Oracle Solaris Third-Party Patch Update : php (cve_2013_4113_buffer_errors)	Nessus	Solaris Local Security Checks	critical
77455	GLSA-201408-11 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75096	openSUSE Security Update : php5 (openSUSE-SU-2013:1244-1)	Nessus	SuSE Local Security Checks	high
69296	SuSE 11.2 / 11.3 Security Update : PHP5 (SAT Patch Numbers 8087 / 8088)	Nessus	SuSE Local Security Checks	high
69295	SuSE 11.2 / 11.3 Security Update : PHP5 (SAT Patch Numbers 8087 / 8088)	Nessus	SuSE Local Security Checks	high
69294	SuSE 11.2 Security Update : PHP5 (SAT Patch Number 8086)	Nessus	SuSE Local Security Checks	high
69172	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 8647)	Nessus	SuSE Local Security Checks	high
68923	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : php5 vulnerabilities (USN-1905-1)	Nessus	Ubuntu Local Security Checks	medium
68918	FreeBSD : PHP5 -- Integer overflow in Calendar module (5def3175-f3f9-4476-ba40-b46627cc638c)	Nessus	FreeBSD Local Security Checks	medium
6866	PHP < 5.3.26 / 5.4.x < 5.4.16 Heap Based Buffer Overflow	Nessus Network Monitor	Web Servers	medium
66843	PHP 5.4.x < 5.4.16 Multiple Vulnerabilities	Nessus	CGI abuses	medium
66842	PHP 5.3.x < 5.3.26 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2013-4635

high

Tenable Plugins

medium

critical

high

high

high

high

high

high

medium

medium

medium

medium

medium