Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

PHP 5.4.x < 5.4.28 / 5.5.x < 5.5.12 Privilege Escalation

Medium

Synopsis

The remote web server uses a version of PHP that is affected by a privilege escalation vulnerability.

Description

Versions of PHP 5.4.x earlier than 5.4.28, or 5.5.x earlier than 5.5.12 are exposed to a flaw that exists within the FastCGI Process Manager (FPM) when setting permissions for a Unix socket. This could allow a remote attacker to gain elevated privileges after gaining access to the socket.

Solution

Apply the vendor patch or upgrade to PHP version 5.5.12 or later. If 5.5.x cannot be installed, 5.4.28 is also patched for these vulnerabilities.