Mandrake Linux Security Advisory : mod_php3 (MDKSA-2000:062)

Critical Nessus Plugin ID 61849


The remote Mandrake Linux host is missing one or more security updates.


PHP version 3 which ships with Linux-Mandrake are vulnerable to format string attacks due to logging functions that make improper use of the syslog() and vsnprintf() functions. This renders PHP3-enabled servers vulnerable to compromise by remote attackers. This attack is only effective on PHP installations that log errors and warnings while those servers that do not are not affected. By default, Linux-Mandrake systems do not have logging enabled.


Update the affected packages.

Plugin Details

Severity: Critical

ID: 61849

File Name: mandrake_MDKSA-2000-062.nasl

Version: $Revision: 1.3 $

Type: local

Published: 2012/09/06

Modified: 2013/05/31

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:mod_php3, p-cpe:/a:mandriva:linux:mod_php3-imap, p-cpe:/a:mandriva:linux:mod_php3-ldap, p-cpe:/a:mandriva:linux:mod_php3-manual, p-cpe:/a:mandriva:linux:mod_php3-mysql, p-cpe:/a:mandriva:linux:mod_php3-pgsql, cpe:/o:mandrakesoft:mandrake_linux:6.1, cpe:/o:mandrakesoft:mandrake_linux:7.0, cpe:/o:mandrakesoft:mandrake_linux:7.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2000/10/12

Reference Information

CVE: CVE-2000-0967

MDKSA: 2000:062