Amazon Linux AMI : php (ALAS-2011-7)

High Nessus Plugin ID 78268

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 6.1

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.

The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the
__autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

php: changes to is_a() in 5.3.7 may allow arbitrary code execution with certain code

A signedness issue was found in the way the PHP crypt() function handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII character (one with the high bit set) had no effect on the hash result, thus shortening the effective password length. This made brute-force guessing more efficient as several different passwords were hashed to the same value.

A signedness issue was found in the way the crypt() function in the PostgreSQL pgcrypto module handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII character (one with the high bit set) had no effect on the hash result, thus shortening the effective password length. This made brute-force guessing more efficient as several different passwords were hashed to the same value.

crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.

A stack-based buffer overflow flaw was found in the way the PHP socket extension handled long AF_UNIX socket addresses. An attacker able to make a PHP script connect to a long AF_UNIX socket address could use this flaw to crash the PHP interpreter.

Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a 'file path injection vulnerability.'

An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the 'apache' user, preventing it from writing to the root directory.

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a 'file path injection vulnerability.'

Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.

A use-after-free flaw was found in the PHP substr_replace() function.
If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code.

Solution

Run 'yum update php' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2011-7.html

Plugin Details

Severity: High

ID: 78268

File Name: ala_ALAS-2011-7.nasl

Version: 1.5

Type: local

Agent: unix

Published: 2014/10/12

Updated: 2019/07/10

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 6.1

CVSS v2.0

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:php, p-cpe:/a:amazon:linux:php-bcmath, p-cpe:/a:amazon:linux:php-cli, p-cpe:/a:amazon:linux:php-common, p-cpe:/a:amazon:linux:php-dba, p-cpe:/a:amazon:linux:php-debuginfo, p-cpe:/a:amazon:linux:php-devel, p-cpe:/a:amazon:linux:php-embedded, p-cpe:/a:amazon:linux:php-fpm, p-cpe:/a:amazon:linux:php-gd, p-cpe:/a:amazon:linux:php-imap, p-cpe:/a:amazon:linux:php-intl, p-cpe:/a:amazon:linux:php-ldap, p-cpe:/a:amazon:linux:php-mbstring, p-cpe:/a:amazon:linux:php-mcrypt, p-cpe:/a:amazon:linux:php-mssql, p-cpe:/a:amazon:linux:php-mysql, p-cpe:/a:amazon:linux:php-odbc, p-cpe:/a:amazon:linux:php-pdo, p-cpe:/a:amazon:linux:php-pgsql, p-cpe:/a:amazon:linux:php-process, p-cpe:/a:amazon:linux:php-pspell, p-cpe:/a:amazon:linux:php-snmp, p-cpe:/a:amazon:linux:php-soap, p-cpe:/a:amazon:linux:php-tidy, p-cpe:/a:amazon:linux:php-xml, p-cpe:/a:amazon:linux:php-xmlrpc, p-cpe:/a:amazon:linux:php-zts, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Patch Publication Date: 2014/09/14

Vulnerability Publication Date: 2011/03/18

Reference Information

CVE: CVE-2011-1148, CVE-2011-1938, CVE-2011-2202, CVE-2011-2483, CVE-2011-3182, CVE-2011-3379

ALAS: 2011-7