Detections
Analytics

PHP 7.4.x < 7.4.12 DoS

medium Nessus Plugin ID 142904

Language:

Synopsis

The version of PHP running on the remote web server is affected by a Denial of Service vulnerability

Description

A denial of service (DoS) vulnerability exists in PHP due to `zend_fake_get_properties` in `ext/ffi/ffi.c` returning a pointer to const HashTable `zend_empty_array`. An unauthenticated, remote attacker can exploit this issue, via a specially crafted request, to cause the application to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

Solution

Upgrade to PHP version 7.4.12 or later.

See Also

http://php.net/ChangeLog-7.php#7.4.12

Plugin Details

Severity: Medium

ID: 142904

File Name: php_7_4_12.nasl

Version: 1.3

Type: remote

Family: CGI abuses

Published: 11/16/2020

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Score based on analysis of the vendor advisory.

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: manual

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: cpe:/a:php:php

Required KB Items: www/PHP, installed_sw/PHP

Patch Publication Date: 10/29/2020

Vulnerability Publication Date: 10/29/2020

Reference Information

IAVA: 2020-A-0510-S