PHP 5.4.x < 5.4.44 / 5.5.x < 5.5.28 / 5.6.x < 5.6.12 Multiple Vulnerabilities

High Nessus Network Monitor Plugin ID 8959

Synopsis

The remote web server uses a version of PHP that is affected by multiple vulnerabilities.

Description

Versions of PHP 5.4.x earlier than 5.4.44, 5.5.x earlier than 5.5.28, or 5.6.x earlier than 5.6.12 are vulnerable to the following issues :

- A use-after-free error exists in file 'spl_dllist.c' due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplDoublyLinkedList object, to deference freed memory and thus execute arbitrary code. (OSVDB 125849)
- A use-after-free error exists in file 'spl_observer.c' due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplObjectStorage object, to deference freed memory and thus execute arbitrary code. (OSVDB 125850)
- A use-after-free error exists in file 'spl_array.c' due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplArrayObject object, to deference freed memory and thus execute arbitrary code. (OSVDB 125851)
- A flaw exists in file 'zend_exceptions.c' due to the improper use of the function unserialize() during recursive method calls. A remote attacker can exploit this to crash an application using PHP. (OSVDB 125852)
- A flaw exists in file 'zend_exceptions.c' due to insufficient type checking by functions unserialize() and __toString(). A remote attacker can exploit this to cause a NULL pointer deference or unexpected method execution, thus causing an application using PHP to crash. (OSVDB 125853)
- A path traversal flaw exists in file 'phar_object.c' due to improper sanitization of user-supplied input. An attacker can exploit this to write arbitrary files. (OSVDB 125854)
- Multiple type confusion flaws exist in the _call() method in file 'php_http.c' when handling calls for zend_hash_get_current_key or 'Z*'. An attacker can exploit this to disclose memory contents or crash an application using PHP. (OSVDB 125855)
- A dangling pointer error exists in file 'spl_array.c' due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplDoublyLinkedList object, to gain control over a deallocated pointer and thus execute arbitrary code. (OSVDB 125856)
- The openssl_random_pseudo_bytes() function in file 'openssl.c' does not generate sufficiently random numbers. This allows an attacker to more easily predict the results, thus allowing further attacks to be carried out. (OSVDB 125859)
- An integer truncation flaw exists in the zend_hash_compare() function in 'zend_hash.c' that is triggered when comparing arrays. A remote attacker can exploit this to cause arrays to be improperly matched during comparison. (OSVDB 127367)

Solution

Upgrade to PHP version 5.6.12 or later. If 5.6.12 cannot be installed, 5.4.44 and 5.5.28 are also patched for these vulnerabilities.

See Also

http://php.net/ChangeLog-5.php#5.6.12

http://php.net/ChangeLog-5.php#5.5.28

http://php.net/ChangeLog-5.php#5.4.44

https://bugs.php.net/bug.php?id=70169

https://bugs.php.net/bug.php?id=70168

https://bugs.php.net/bug.php?id=70166

https://bugs.php.net/bug.php?id=69793

https://bugs.php.net/bug.php?id=70019

https://bugs.php.net/bug.php?id=70014

https://bugs.php.net/bug.php?id=69892

Plugin Details

Severity: High

ID: 8959

Family: Web Servers

Published: 2015/10/08

Modified: 2016/11/23

Dependencies: 8682

Nessus ID: 85298, 85299, 85300

Risk Information

Risk Factor: High

CVSSv2

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 8.1

Temporal Score: 7.5

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:php:php

Patch Publication Date: 2015/08/06

Vulnerability Publication Date: 2015/07/30

Reference Information

CVE: CVE-2015-6831, CVE-2015-6832, CVE-2015-6833

BID: 31967, 76735, 76739, 76737