PHP 5.4.x < 5.4.38 / 5.5.x < 5.5.22 / 5.6.x < 5.6.6 Multiple Vulnerabilities (GHOST)

Critical Nessus Network Monitor Plugin ID 8677

Synopsis

The remote web server uses a version of PHP that is affected by multiple vulnerabilities.

Description

Versions of PHP 5.4.x earlier than 5.4.38, 5.5.x earlier than 5.5.22, or 5.6.x earlier than 5.6.6 are exposed to the following issues :

- A heap-based buffer overflow flaw in the GNU C Library (glibc) due to improperly validating user-supplied input in the glibc functions __nss_hostname_digits_dots(), gethostbyname(), and gethostbyname2(). This allows a remote attacker to cause a buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (GHOST) (Bug 68925 / CVE-2015-0235)

- A use-after-free flaw exists in the function php_date_timezone_initialize_from_hash() within the 'ext/date/php_date.c' script. An attacker can exploit this to access sensitive information or crash applications linked to PHP. (Bug 68942 / CVE-2015-0273)

- A use-after-free flaw exists in the function 'phar_rename_archive' in the source file 'phar_object.c'. An attacker can cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file. (Bug 68901 / CVE-2015-2301)

- A heap-based buffer overflow flaw affects the 'enchant_broker_request_dict' function in the source file 'ext/enchant/enchant.c'. This allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries. (Bug 68552 / CVE-2014-9705)

Solution

Apply the vendor patch or upgrade to PHP version 5.6.6 or later. If 5.6.x cannot be installed, 5.4.38 and 5.5.22 are also patched for these vulnerabilities.

See Also

http://www.nessus.org/u?c7a6ddbd

https://bugs.php.net/bug.php?id=68942

https://bugs.php.net/bug.php?id=68901

https://bugs.php.net/bug.php?id=68827

https://bugs.php.net/bug.php?id=68552

https://bugs.php.net/bug.php?id=68925

http://www.php.net/ChangeLog-5.php#5.6.6

Plugin Details

Severity: Critical

ID: 8677

Family: Web Servers

Published: 2015/04/09

Modified: 2018/09/16

Dependencies: 8682

Nessus ID: 81510, 81511, 81512

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSSv3

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:php:php

Patch Publication Date: 2015/02/19

Vulnerability Publication Date: 2015/01/12

Exploitable With

Core Impact

Metasploit (Exim GHOST (glibc gethostbyname) Buffer Overflow)

Reference Information

CVE: CVE-2015-0235, CVE-2015-0273, CVE-2015-2301, CVE-2014-9705

BID: 72701, 73037, 73034, 73031, 72325