Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : php5 vulnerabilities (USN-2952-1)

Ubuntu Security Notice (C) 2016 Canonical, Inc. / NASL script (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

It was discovered that the PHP Zip extension incorrectly handled
directories when processing certain zip files. A remote attacker could
possibly use this issue to create arbitrary directories.
(CVE-2014-9767)

It was discovered that the PHP Soap client incorrectly validated data
types. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2015-8835, CVE-2016-3185)

It was discovered that the PHP MySQL native driver incorrectly handled
TLS connections to MySQL databases. A man in the middle attacker could
possibly use this issue to downgrade and snoop on TLS connections.
This vulnerability is known as BACKRONYM. (CVE-2015-8838)

It was discovered that PHP incorrectly handled the imagerotate
function. A remote attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly obtain sensitive
information. This issue only applied to Ubuntu 14.04 LTS and Ubuntu
15.10. (CVE-2016-1903)

Hans Jerry Illikainen discovered that the PHP phar extension
incorrectly handled certain tar archives. A remote attacker could use
this issue to cause PHP to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2016-2554)

It was discovered that the PHP WDDX extension incorrectly handled
certain malformed XML data. A remote attacker could possibly use this
issue to cause PHP to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2016-3141)

It was discovered that the PHP phar extension incorrectly handled
certain zip files. A remote attacker could use this issue to cause PHP
to crash, resulting in a denial of service, or possibly obtain
sensitive information. (CVE-2016-3142)

It was discovered that the PHP libxml_disable_entity_loader() setting
was shared between threads. When running under PHP-FPM, this could
result in XML external entity injection and entity expansion issues.
This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No
CVE number)

It was discovered that the PHP openssl_random_pseudo_bytes() function
did not return cryptographically strong pseudo-random bytes. (No CVE
number)

It was discovered that the PHP Fileinfo component incorrectly handled
certain magic files. An attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE number pending)

It was discovered that the PHP php_snmp_error() function incorrectly
handled string formatting. A remote attacker could use this issue to
cause PHP to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS
and Ubuntu 15.10. (CVE number pending)

It was discovered that the PHP rawurlencode() function incorrectly
handled large strings. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service. (CVE number pending)

It was discovered that the PHP phar extension incorrectly handled
certain filenames in archives. A remote attacker could use this issue
to cause PHP to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE number pending)

It was discovered that the PHP mb_strcut() function incorrectly
handled string formatting. A remote attacker could use this issue to
cause PHP to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE number pending).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.8
(CVSS2#E:POC/RL:OF/RC:ND)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 90677 ()

Bugtraq ID:

CVE ID: CVE-2014-9767
CVE-2015-8835
CVE-2015-8838
CVE-2016-1903
CVE-2016-2554
CVE-2016-3141
CVE-2016-3142
CVE-2016-3185

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now