The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl function in ext/soap/php_sdl.c.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP     through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL     injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl     function in ext/soap/php_sdl.c. (CVE-2013-6501)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Versions of PHP 5.4.x earlier than 5.4.40, 5.5.x earlier than 5.5.24, or 5.6.x earlier than 5.6.8 contain a flaw in the cache directory that is due to the program creating files for the cache in a predictable manner. This may allow a remote attacker to inject WSDL files and have them be used in place of the intended file. Specifically, the default 'soap.wsdl_cache_dir' setting in 'php.ini-production' and 'php.ini-development' specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the 'get_sdl' function in 'ext/soap/php_sdl.c'.

php5 has been updated to fix two security issues :

  - Out of bounds read in mconvert(). (bnc#917150).
    (CVE-2014-9652)

  - Use after free vulnerability in unserialize() with     DateTimeZone. (bnc#918768). (CVE-2015-0273)

ID	Name	Product	Family	Type	Severity
218225	Linux Distros Unpatched Vulnerability : CVE-2013-6501	Nessus	Misc.	Local	high
91704	GLSA-201606-10 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
8789	PHP 5.4.x < 5.4.40 / 5.5.x < 5.5.24 / 5.6.x < 5.6.8 'php_sdl.c' WSDL Injection	Nessus Network Monitor	Web Servers		medium
81665	SuSE 11.3 Security Update : PHP 5.3 (SAT Patch Number 10370)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2013-6501

high

Tenable Plugins

high

critical

medium

high