Detections
Analytics

Amazon Linux AMI : php56 / php70,php71,php72 (ALAS-2019-1147)

high Nessus Plugin ID 121132

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.(CVE-2018-19935)

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a '-oProxyCommand' argument.(CVE-2018-19518)

Solution

Run 'yum update php56' to update your system.

Run 'yum update php70' to update your system.

Run 'yum update php71' to update your system.

Run 'yum update php72' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2019-1147.html

Plugin Details

Severity: High

ID: 121132

File Name: ala_ALAS-2019-1147.nasl

Version: 1.4

Type: local

Agent: unix

Published: 1/14/2019

Updated: 4/4/2019

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 7

Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 7

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:php56, p-cpe:/a:amazon:linux:php56-bcmath, p-cpe:/a:amazon:linux:php56-cli, p-cpe:/a:amazon:linux:php56-common, p-cpe:/a:amazon:linux:php56-dba, p-cpe:/a:amazon:linux:php56-dbg, p-cpe:/a:amazon:linux:php56-debuginfo, p-cpe:/a:amazon:linux:php56-devel, p-cpe:/a:amazon:linux:php56-embedded, p-cpe:/a:amazon:linux:php56-enchant, p-cpe:/a:amazon:linux:php56-fpm, p-cpe:/a:amazon:linux:php56-gd, p-cpe:/a:amazon:linux:php56-gmp, p-cpe:/a:amazon:linux:php56-imap, p-cpe:/a:amazon:linux:php56-intl, p-cpe:/a:amazon:linux:php56-ldap, p-cpe:/a:amazon:linux:php56-mbstring, p-cpe:/a:amazon:linux:php56-mcrypt, p-cpe:/a:amazon:linux:php56-mssql, p-cpe:/a:amazon:linux:php56-mysqlnd, p-cpe:/a:amazon:linux:php56-odbc, p-cpe:/a:amazon:linux:php56-opcache, p-cpe:/a:amazon:linux:php56-pdo, p-cpe:/a:amazon:linux:php56-pgsql, p-cpe:/a:amazon:linux:php56-process, p-cpe:/a:amazon:linux:php56-pspell, p-cpe:/a:amazon:linux:php56-recode, p-cpe:/a:amazon:linux:php56-snmp, p-cpe:/a:amazon:linux:php56-soap, p-cpe:/a:amazon:linux:php56-tidy, p-cpe:/a:amazon:linux:php56-xml, p-cpe:/a:amazon:linux:php56-xmlrpc, p-cpe:/a:amazon:linux:php70, p-cpe:/a:amazon:linux:php70-bcmath, p-cpe:/a:amazon:linux:php70-cli, p-cpe:/a:amazon:linux:php70-common, p-cpe:/a:amazon:linux:php70-dba, p-cpe:/a:amazon:linux:php70-dbg, p-cpe:/a:amazon:linux:php70-debuginfo, p-cpe:/a:amazon:linux:php70-devel, p-cpe:/a:amazon:linux:php70-embedded, p-cpe:/a:amazon:linux:php70-enchant, p-cpe:/a:amazon:linux:php70-fpm, p-cpe:/a:amazon:linux:php70-gd, p-cpe:/a:amazon:linux:php70-gmp, p-cpe:/a:amazon:linux:php70-imap, p-cpe:/a:amazon:linux:php70-intl, p-cpe:/a:amazon:linux:php70-json, p-cpe:/a:amazon:linux:php70-ldap, p-cpe:/a:amazon:linux:php70-mbstring, p-cpe:/a:amazon:linux:php70-mcrypt, p-cpe:/a:amazon:linux:php70-mysqlnd, p-cpe:/a:amazon:linux:php70-odbc, p-cpe:/a:amazon:linux:php70-opcache, p-cpe:/a:amazon:linux:php70-pdo, p-cpe:/a:amazon:linux:php70-pdo-dblib, p-cpe:/a:amazon:linux:php70-pgsql, p-cpe:/a:amazon:linux:php70-process, p-cpe:/a:amazon:linux:php70-pspell, p-cpe:/a:amazon:linux:php70-recode, p-cpe:/a:amazon:linux:php70-snmp, p-cpe:/a:amazon:linux:php70-soap, p-cpe:/a:amazon:linux:php70-tidy, p-cpe:/a:amazon:linux:php70-xml, p-cpe:/a:amazon:linux:php70-xmlrpc, p-cpe:/a:amazon:linux:php70-zip, p-cpe:/a:amazon:linux:php71, p-cpe:/a:amazon:linux:php71-bcmath, p-cpe:/a:amazon:linux:php71-cli, p-cpe:/a:amazon:linux:php71-common, p-cpe:/a:amazon:linux:php71-dba, p-cpe:/a:amazon:linux:php71-dbg, p-cpe:/a:amazon:linux:php71-debuginfo, p-cpe:/a:amazon:linux:php71-devel, p-cpe:/a:amazon:linux:php71-embedded, p-cpe:/a:amazon:linux:php71-enchant, p-cpe:/a:amazon:linux:php71-fpm, p-cpe:/a:amazon:linux:php71-gd, p-cpe:/a:amazon:linux:php71-gmp, p-cpe:/a:amazon:linux:php71-imap, p-cpe:/a:amazon:linux:php71-intl, p-cpe:/a:amazon:linux:php71-json, p-cpe:/a:amazon:linux:php71-ldap, p-cpe:/a:amazon:linux:php71-mbstring, p-cpe:/a:amazon:linux:php71-mcrypt, p-cpe:/a:amazon:linux:php71-mysqlnd, p-cpe:/a:amazon:linux:php71-odbc, p-cpe:/a:amazon:linux:php71-opcache, p-cpe:/a:amazon:linux:php71-pdo, p-cpe:/a:amazon:linux:php71-pdo-dblib, p-cpe:/a:amazon:linux:php71-pgsql, p-cpe:/a:amazon:linux:php71-process, p-cpe:/a:amazon:linux:php71-pspell, p-cpe:/a:amazon:linux:php71-recode, p-cpe:/a:amazon:linux:php71-snmp, p-cpe:/a:amazon:linux:php71-soap, p-cpe:/a:amazon:linux:php71-tidy, p-cpe:/a:amazon:linux:php71-xml, p-cpe:/a:amazon:linux:php71-xmlrpc, p-cpe:/a:amazon:linux:php72, p-cpe:/a:amazon:linux:php72-bcmath, p-cpe:/a:amazon:linux:php72-cli, p-cpe:/a:amazon:linux:php72-common, p-cpe:/a:amazon:linux:php72-dba, p-cpe:/a:amazon:linux:php72-dbg, p-cpe:/a:amazon:linux:php72-debuginfo, p-cpe:/a:amazon:linux:php72-devel, p-cpe:/a:amazon:linux:php72-embedded, p-cpe:/a:amazon:linux:php72-enchant, p-cpe:/a:amazon:linux:php72-fpm, p-cpe:/a:amazon:linux:php72-gd, p-cpe:/a:amazon:linux:php72-gmp, p-cpe:/a:amazon:linux:php72-imap, p-cpe:/a:amazon:linux:php72-intl, p-cpe:/a:amazon:linux:php72-json, p-cpe:/a:amazon:linux:php72-ldap, p-cpe:/a:amazon:linux:php72-mbstring, p-cpe:/a:amazon:linux:php72-mysqlnd, p-cpe:/a:amazon:linux:php72-odbc, p-cpe:/a:amazon:linux:php72-opcache, p-cpe:/a:amazon:linux:php72-pdo, p-cpe:/a:amazon:linux:php72-pdo-dblib, p-cpe:/a:amazon:linux:php72-pgsql, p-cpe:/a:amazon:linux:php72-process, p-cpe:/a:amazon:linux:php72-pspell, p-cpe:/a:amazon:linux:php72-recode, p-cpe:/a:amazon:linux:php72-snmp, p-cpe:/a:amazon:linux:php72-soap, p-cpe:/a:amazon:linux:php72-tidy, p-cpe:/a:amazon:linux:php72-xml, p-cpe:/a:amazon:linux:php72-xmlrpc, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/12/2019

Vulnerability Publication Date: 11/25/2018

Exploitable With

Metasploit (php imap_open Remote Code Execution)

Reference Information

CVE: CVE-2018-19518, CVE-2018-19935

ALAS: 2019-1147