PHP 是一种嵌入了 HTML 的脚本语言，通常用于 Apache HTTP Server。

已发现 PHP XSL 扩展未限制 libxslt 的文件写入功能。如果 PHP 脚本处理不受信任的可扩展样式表语言转换 (XSLT) 内容，则远程攻击者可利用此缺陷创建或覆盖运行 PHP 的用户可写入的任意文件。(CVE-2012-0057)

注意：默认情况下，此更新会禁用文件写入。可以使用新的 PHP 配置指令“xsl.security_prefs”来启用 XSLT 中的文件写入。

在 PHP 验证文件上传请求中的文件名的方式中发现一个缺陷。远程攻击者可能利用此缺陷绕过已上传文件名的审查，导致 PHP 脚本通过使用目录遍历攻击在意外目录中存储上传的文件。(CVE-2012-1172)

在 PHP phar 扩展处理 tar 存档文件的某些字段的方式中发现多种整数溢出缺陷，可导致基于堆的缓冲区溢出。远程攻击者可提供特别构建的 tar 存档文件，在由使用 phar 扩展的 PHP 应用程序处理该文件时，可导致该应用程序崩溃，或者可能以运行 PHP 的用户的权限执行任意代码。(CVE-2012-2386)

在 PHP phar 扩展处理某些 PHAR 文件的方式中发现格式字符串缺陷。远程攻击者可提供特别构建的 PHAR 文件，在由使用 phar 扩展的 PHP 应用程序处理该文件后，可导致信息泄露并且可能通过构建的 phar:// URI 执行任意代码。
(CVE-2010-2950)

在 PHP 的 crypt() 密码哈希函数的 DES 算法实现中发现一个缺陷。如果要哈希处理的密码字符串含有某些字符，则在计算哈希时会忽略该字符串的剩余部分，从而明显减小密码强度。(CVE-2012-2143)

注意：通过此更新，执行 DES 哈希处理时不再截断密码。因此，受影响密码的新哈希将与使用易受攻击的 PHP 版本生成的已存储哈希不一致，并且将需要进行更新。

已发现通过之前的更新发布的针对 CVE-2012-1823 的补丁未正确过滤所有 php-cgi 命令行参数。特别构建的 PHP 脚本请求可导致 PHP 解释器循环执行脚本或输出触发内部服务器错误的使用情况信息。(CVE-2012-2336)

在 PHP strtotime() 函数调用中发现一个内存泄漏缺陷。远程攻击者可能利用此缺陷通过触发许多 strtotime() 函数调用来导致过量内存消耗。
(CVE-2012-0789)

在 PHP tidy_diagnose() 函数中发现一个空指针取消引用缺陷。远程攻击者可利用特别构建的输入导致使用 tidy::diagnose 的应用程序崩溃。(CVE-2012-0781)

已发现 PHP 在某些情况下未检查 zend_strndup() 函数的返回值。远程攻击者可能利用此缺陷导致 PHP 应用程序崩溃。(CVE-2011-4153)

所有 php 用户都应升级这些更新后的程序包，其中包含用于解决这些问题的向后移植的修补程序。安装更新后的程序包后，必须重新启动 httpd 后台程序才能使更新生效。

远程主机受到 GLSA-201110-06 中所述漏洞的影响（PHP：多种漏洞）

已在 PHP 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

上下文有关的攻击者可通过多种方式执行任意代码、从进程内存获取敏感信息、绕过预期访问限制，或造成拒绝服务。
 远程攻击者可通过多种方式造成拒绝服务、绕过垃圾邮件检测，或绕过 open_basedir 限制。
 变通方案：

目前无任何已知的变通方案。

This is a maintenance and security update that upgrades php to 5.3.4 for 2010.0/2010.1.

Security Enhancements and Fixes in PHP 5.3.4 :

  - Paths with NULL in them (foo\0bar.txt) are now     considered as invalid (CVE-2006-7243).

  - Fixed bug #53512 (NumberFormatter::setSymbol crash on     bogus values) (CVE-2010-4409)

Please note that CVE-2010-4150, CVE-2010-3870, CVE-2010-3436, CVE-2010-3709, CVE-2010-3710 were fixed in previous advisories.

Key Bug Fixes in PHP 5.3.4 include :

  - Added stat support for zip stream.

    - Added follow_location (enabled by default) option for       the http stream support.

  - Added a 3rd parameter to get_html_translation_table. It     now takes a charset hint, like htmlentities et al.

  - Implemented FR #52348, added new constant ZEND_MULTIBYTE     to detect zend multibyte at runtime.

  - Multiple improvements to the FPM SAPI.

    - Over 100 other bug fixes.

Additional post 5.3.4 fixes :

  - Fixed bug #53517 (segfault in pgsql_stmt_execute() when     postgres is down).

  - Fixed bug #53541 (format string bug in ext/phar).

Additionally some of the PECL extensions has been upgraded and/or rebuilt for the new php version.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1046 advisory.

  - php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024) (CVE-2010-2950)

  - php: zend_strndup() NULL pointer dereference may cause DoS (CVE-2011-4153)

  - php: XSLT file writing vulnerability (CVE-2012-0057)

  - php: tidy_diagnose() NULL pointer dereference may cause DoS (CVE-2012-0781)

  - php: strtotime timezone memory leak (CVE-2012-0789)

  - php: $_FILES array indexes corruption (CVE-2012-1172)

  - BSD crypt(): DES encrypted password weakness (CVE-2012-2143)

  - php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h (CVE-2012-2336)

  - php: Integer overflow leading to heap-buffer overflow in the Phar extension (CVE-2012-2386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057)

Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT.

A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386)

A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI.
(CVE-2010-2950)

A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143)

Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated.

It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0547, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336)

A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls.
(CVE-2012-0789)

It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153)

Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143.

All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057)

Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT.

A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386)

A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI.
(CVE-2010-2950)

A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143)

Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated.

It was discovered that the fix for CVE-2012-1823, released via a previous update, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336)

A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls.
(CVE-2012-0789)

It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153)

All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057)

Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT.

A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386)

A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI.
(CVE-2010-2950)

A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143)

Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated.

It was discovered that the fix for CVE-2012-1823, released via a previous update, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336)

A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls.
(CVE-2012-0789)

A NULL pointer dereference flaw was found in the PHP tidy_diagnose() function. A remote attacker could use specially crafted input to crash an application that uses tidy::diagnose. (CVE-2012-0781)

It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153)

All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201110-06 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code, obtain       sensitive information from process memory, bypass intended access       restrictions, or cause a Denial of Service in various ways.
    A remote attacker could cause a Denial of Service in various ways,       bypass spam detections, or bypass open_basedir restrictions.
  Workaround :

    There is no known workaround at this time.

According to its banner the version of PHP installed on the remote host is 5.3.x earlier than 5.3.4.  Such versions are potentially affected by multiple vulnerabilities :

  - A crash in the zip extract method.
  - A stack buffer overflow in impagepstext() of the GD extension.
  - An unspecified vulnerability related to symbolic resolution when using a DFS share.
  - A security bypass vulnerability related to using pathnames containing NULL bytes. (CVE-2006-7243)
  - Multiple format string vulnerabilities. (CVE-2010-2094, CVE-2010-2950)
  - An unspecified security bypass vulnerability in open_basedir(). (CVE-2010-3436)
  - A NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709)
  - Memory corruption in php_filter_validate_email(). (CVE-2010-3710)
  - An input validation vulnerability in xml_utf8_decode(). (CVE-2010-3870)
  - A possible double free in the IMAP extension. (CVE-2010-4150)
  - An information disclosure vulnerability in 'mb_strcut()'. (CVE-2010-4156)
  - An integer overflow vulnerability in 'getSymbol()'. (CVE-2010-4409)
  - A use-after-free vulnerability in the Zend engine when a '__set()', '__get()', '__isset()' or '__unset()' method is called can allow for a denial of service attack. (Bug #52879 / CVE-2010-4697)
  - A stack-based buffer overflow exists in the 'imagepstext()' function in the GD extension. (Bug #53492 / CVE-2010-4698)
  - The 'iconv_mime_decode_headers()' function in the iconv extension fails to properly handle encodings that are not recognized by the iconv and mbstring implementations. (Bug #52941 / CVE-2010-4699)
  - The 'set_magic_quotes_runtime()' function when the MySQLi extension is used does not properly interact with the 'mysqli_fetch_assoc()' function. (Bug #52221 / CVE-2010-4700)
  - A race condition exists in the PCNTL extension. (CVE-2011-0753)
  - The SplFileInfo::getType function in the Standard PHP Library extension does not properly detect symbolic links. (CVE-2011-0754)
  - An integer overflow exists in the mt_rand function. (CVE-2011-0755)

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

According to its banner the version of PHP installed on the remote host is 5.3.x earlier than 5.3.4.  Such versions are potentially affected by multiple vulnerabilities :

  - A crash in the zip extract method.

  - A stack buffer overflow in impagepstext() of the GD extension.

  - An unspecified vulnerability related to symbolic resolution when using a DFS share.

  - A security bypass vulnerability related to using pathnames containing NULL bytes. (CVE-2006-7243)

  - Multiple format string vulnerabilities. (CVE-2010-2094, CVE-2010-2950)

  - An unspecified security bypass vulnerability in open_basedir(). (CVE-2010-3436)

  - A NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709)

  - Memory corruption in php_filter_validate_email(). (CVE-2010-3710)

  - An input validation vulnerability in xml_utf8_decode(). (CVE-2010-3870)

  - A possible double free in the IMAP extension. (CVE-2010-4150)
  - An information disclosure vulnerability in 'mb_strcut()'. (CVE-2010-4156)

  - An integer overflow vulnerability in 'getSymbol()'. (CVE-2010-4409)

  - A use-after-free vulnerability in the Zend engine when a '__set()', '__get()', '__isset()' or '__unset()' method is called can allow for a denial of service attack. (Bug #52879 / CVE-2010-4697)

  - A stack-based buffer overflow exists in the 'imagepstext()' function in the GD extension. (Bug #53492 / CVE-2010-4698)

  - The 'iconv_mime_decode_headers()' function in the iconv extension fails to properly handle encodings that are not recognized by the iconv and mbstring implementations. (Bug #52941 / CVE-2010-4699)

  - The 'set_magic_quotes_runtime()' function when the MySQLi extension is used does not properly interact with the 'mysqli_fetch_assoc()' function. (Bug #52221 / CVE-2010-4700)

  - A race condition exists in the PCNTL extension. (CVE-2011-0753)

  - The SplFileInfo::getType function in the Standard PHP Library extension does not properly detect symbolic links. (CVE-2011-0754)

  - An integer overflow exists in the mt_rand function. (CVE-2011-0755)

ID	名稱	產品	系列	已發布	已更新	嚴重性
61358	Scientific Linux 安全更新：SL6.x i386/x86_64 中的 php	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
56459	GLSA-201110-06：PHP：多种漏洞	Nessus	Gentoo Local Security Checks	2011/10/12	2021/1/6	critical
51196	Mandriva Linux Security Advisory : php (MDVSA-2010:254)	Nessus	Mandriva Local Security Checks	2010/12/16	2021/1/6	medium
59752	RHEL 6 : php (RHSA-2012:1046)	Nessus	Red Hat Local Security Checks	2012/6/28	2024/4/21	critical
59753	RHEL 5 : php53 (RHSA-2012:1047)	Nessus	Red Hat Local Security Checks	2012/6/28	2021/1/14	high
61356	Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120627)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
61358	Scientific Linux Security Update : php on SL6.x i386/x86_64 (20120627)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
56459	GLSA-201110-06 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2011/10/12	2021/1/6	critical
5732	PHP 5.3.x < 5.3.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2010/12/10	2019/3/6	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2011/3/21	2019/3/6	critical
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	2011/3/21		high
801074	PHP 5.3 < 5.3.4 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	2010/12/10		high

偵測

搜尋 Plugin

high

critical

medium

critical

high

high

high

critical

high

critical

high

high