PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.

The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the
__autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

php: changes to is_a() in 5.3.7 may allow arbitrary code execution with certain code

A signedness issue was found in the way the PHP crypt() function handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII character (one with the high bit set) had no effect on the hash result, thus shortening the effective password length. This made brute-force guessing more efficient as several different passwords were hashed to the same value.

A signedness issue was found in the way the crypt() function in the PostgreSQL pgcrypto module handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII character (one with the high bit set) had no effect on the hash result, thus shortening the effective password length. This made brute-force guessing more efficient as several different passwords were hashed to the same value.

crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.

A stack-based buffer overflow flaw was found in the way the PHP socket extension handled long AF_UNIX socket addresses. An attacker able to make a PHP script connect to a long AF_UNIX socket address could use this flaw to crash the PHP interpreter.

Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a 'file path injection vulnerability.'

An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the 'apache' user, preventing it from writing to the root directory.

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a 'file path injection vulnerability.'

Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.

A use-after-free flaw was found in the PHP substr_replace() function.
If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code.

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters (e.g. umlauts).
Affected passwords are potentially faster to crack via brute-force methods. (CVE-2011-2483)

SUSE's crypt() implementation supports the blowfish password hashing function (id $2a) and system logins by default also use this method.
This update eliminates the bug in the $2a implementation. After installing the update existing $2a hashes therefore no longer match hashes generated with the new, correct implementation if the password contains 8bit characters. For system logins via PAM the pam_unix2 module activates a compat mode and keeps processing existing $2a hashes with the old algorithm. This ensures no user gets locked out.
New passwords hashes are created with the id '$2y' to unambiguously identify them as generated with the correct implementation.

Note: To actually migrate hashes to the new algorithm all users are advised to change passwords after the update.

Services that do not use PAM but do use crypt() to store passwords using the blowfish hash do not have such a compat mode. That means users with 8bit passwords that use such services will not be able to log in anymore after the update. As workaround administrators may edit the service's password database and change stored hashes from $2a to $2x. This will result in crypt() using the old algorithm. Users should be required to change their passwords to make sure they are migrated to the correct algorithm.

FAQ :

Q: I only use ASCII characters in passwords, am I a affected in any way? A: No.

Q: What's the meaning of the ids before and after the update? A:
Before the update: $2a -> buggy algorithm

After the update: $2x -> buggy algorithm $2a -> correct algorithm $2y
-> correct algorithm

System logins using PAM have a compat mode enabled by default: $2x -> buggy algorithm $2a -> buggy algorithm $2y -> correct algorithm

Q: How do I require users to change their password on next login? A:
Run the following command as root for each user: chage -d 0

Q: I run an application that has $2a hashes in it's password database.
Some users complain that they can not log in anymore. A: Edit the password database and change the '$2a' prefix of the affected users' hashes to '$2x'. They will be able to log in again but should change their password ASAP.

Q: How do I turn off the compat mode for system logins? A: Set BLOWFISH_2a2x=no in /etc/default/passwd

According to its banner, the version of PHP 5.3.x running on the remote host is prior to 5.3.7. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free vulnerability in substr_replace().
   (CVE-2011-1148)

  - A stack-based buffer overflow in socket_connect().
   (CVE-2011-1938)

  - A code execution vulnerability in ZipArchive::addGlob().
    (CVE-2011-1657)

  - crypt_blowfish was updated to 1.2. (CVE-2011-2483)

  - Multiple NULL pointer dereferences. (CVE-2011-3182)

  - An unspecified crash in error_log(). (CVE-2011-3267)

  - A buffer overflow in crypt(). (CVE-2011-3268)

  - A flaw exists in the php_win32_get_random_bytes()     function when passing MCRYPT_DEV_URANDOM as source to     mcrypt_create_iv(). A remote attacker can exploit this     to cause a denial of service condition.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and     other products, does not properly handle 8-bit characters, which makes it easier for context-dependent     attackers to determine a cleartext password by leveraging knowledge of a password hash. (CVE-2011-2483)

Note that Nessus relies on the presence of the package as reported by the vendor.

The security update for CVE-2011-2483 broke changing blowfish passwords if compat mode was turned on (default). This update fixes the regression.

Manual pages for several kernel and library functions were added. The crypt(3) manual page was updated to also list the 2y prefix.

The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash (CVE-2011-2483). After this update existing hashes with id '$2a$' for passwords that contain 8-bit characters will no longer be compatible with newly generated hashes. Affected users will either have to change their password to store a new hash or the id of the existing hash has to be manually changed to '$2x$' in order to activate a compat mode. Please see the description of the CVE-2011-2483 glibc update for details.

File uploads could potentially overwrite files owned by the user running php (CVE-2011-2202).

A long salt argument to the crypt function could cause a buffer overflow (CVE-2011-3268)

The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash (CVE-2011-2483). After this update existing hashes with id '$2a$' for passwords that contain 8-bit characters will no longer be compatible with newly generated hashes. Affected users will either have to change their password to store a new hash or the id of the existing hash has to be manually changed to '$2x$' in order to activate a compat mode. Please see the description of the CVE-2011-2483 glibc update for details.

File uploads could potentially overwrite files owned by the user running php (CVE-2011-2202).

A long salt argument to the crypt function could cause a buffer overflow (CVE-2011-3268)

Incorrect implementation of the error_log function could crash php (CVE-2011-3267)

The crypt(3) manpage was updated to also list the 2y prefix.

PostgreSQL was updated to the latest stable release 8.1.23, fixing various bugs and security issues.

The following security issues have been fixed :

  - CVE-2012-3488: This update fixes arbitrary read and     write of files via XSL functionality.

  - CVE-2012-2655: postgresql: denial of service (stack     exhaustion) via specially crafted SQL.

  - CVE-2011-2483: crypt_blowfish was mishandling 8 bit     characters.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.7 that is older than version 10.7.3.  The newer version contains numerous security-related fixes for the following components :

  - Address Book
  - Apache
  - ATS
  - CFNetwork
 - CoreMedia
 - CoreText
 - CoreUI
 - curl
 - Data Security
 - dovecot
 - filecmds
 - ImageIO
 - Internet Sharing
 - Libinfo
 - libresolv
 - libsecurity
 - OpenGL
 - PHP
 - QuickTime
 - Subversion
 - Time Machine
 - WebDAV Sharing
 - Webmail
 - X11

Versions of PHP 5.3 earlier than 5.3.7 are potentially affected by multiple vulnerabilities : 

  - A stack buffer overflow exists in socket_connect(). (CVE-2011-1938)

  - A use-after-free vulnerability exists in substr_replace(). (CVE-2011-1148)

  - A code execution vulnerability exists in ZipArchive: : addGlob(). (CVE-2011-1657)

  - crypt_blowfish was updated to 1.2. (CVE-2011-2483)

  - Multiple null pointer dereferences exist.

  - An unspecified crash exists in error_log().

  - A buffer overflow vulnerability exists in crypt().
 - A flaw exists in the php_win32_get_random_bytes() function when passing MCRYPT_DEV_URANDOM as source to mcrypt_create_iv(). A remote attacker can exploit this to cause a denial of service condition.

Versions of PHP 5.3 earlier than 5.3.7 are potentially affected by multiple vulnerabilities : 

  - A stack buffer overflow exists in socket_connect(). (CVE-2011-1938)

  - A use-after-free vulnerability exists in substr_replace(). (CVE-2011-1148)

  - A code execution vulnerability exists in ZipArchive: : addGlob(). (CVE-2011-1657)

  - crypt_blowfish was updated to 1.2. (CVE-2011-2483)

  - Multiple null pointer dereferences exist.

  - An unspecified crash exists in error_log().

  - A buffer overflow vulnerability exists in crypt().

ID	Name	Product	Family	Published	Updated	Severity
78268	Amazon Linux AMI : php (ALAS-2011-7)	Nessus	Amazon Linux Local Security Checks	10/12/2014	7/10/2019	high
55920	SuSE 10 Security Update : glibc (ZYPP Patch Number 7659)	Nessus	SuSE Local Security Checks	8/20/2011	1/19/2021	medium
55925	PHP 5.3 < 5.3.7 Multiple Vulnerabilities	Nessus	CGI abuses	8/22/2011	5/26/2025	critical
217440	Linux Distros Unpatched Vulnerability : CVE-2011-2483	Nessus	Misc.	3/3/2025	3/3/2025	critical
56018	SuSE 11.1 Security Update : libxcrypt (SAT Patch Number 5041)	Nessus	SuSE Local Security Checks	8/31/2011	1/19/2021	medium
56019	SuSE 11.1 Security Update : man-pages (SAT Patch Number 5064)	Nessus	SuSE Local Security Checks	8/31/2011	1/19/2021	medium
58576	SuSE 10 Security Update : glibc (ZYPP Patch Number 7663)	Nessus	SuSE Local Security Checks	4/3/2012	1/19/2021	medium
75433	openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:1137-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
75791	openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:1138-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	critical
75943	openSUSE Security Update : man-pages (openSUSE-SU-2011:0970-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
83561	SUSE SLED10 / SLES10 Security Update : PostgreSQL (SUSE-SU-2012:1336-1)	Nessus	SuSE Local Security Checks	5/20/2015	1/19/2021	medium
6303	Mac OS X 10.7 < 10.7.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2/6/2012	3/6/2019	critical
6015	PHP 5.3.x < 5.3.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	8/23/2011	3/6/2019	high
801087	PHP 5.3 < 5.3.7 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	8/23/2011		high

Detections

Analytics

Plugins Search

high

medium

critical

critical

medium

medium

medium

critical

critical

medium

medium

critical

high

high