PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ';' in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.
(CVE-2006-6383)

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font. PHP uses an embedded copy of GD and may be susceptible to the same issue.
(CVE-2007-0455)

Updated packages have been patched to correct these issues. Users must restart Apache for the changes to take effect.

According to its banner, the version of PHP installed on the remote host is older than 5.2.1.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

This update fixes security problems also fixed in PHP 5.2.1, including following problems :

  - Multiple buffer overflows in PHP before 5.2.1 allow     attackers to cause a denial of service and possibly     execute arbitrary code via unspecified vectors in the     (1) session, (2) zip, (3) imap, and (4) sqlite     extensions; (5) stream filters; and the (6) str_replace,     (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and     (10) ibase_modify_user functions. (CVE-2007-0906)

  - Buffer underflow in PHP before 5.2.1 allows attackers to     cause a denial of service via unspecified vectors     involving the sapi_header_op function. (CVE-2007-0907)

  - The wddx extension in PHP before 5.2.1 allows remote     attackers to obtain sensitive information via     unspecified vectors. (CVE-2007-0908)

  - Multiple format string vulnerabilities in PHP before     5.2.1 might allow attackers to execute arbitrary code     via format string specifiers to (1) all of the *print     functions on 64-bit systems, and (2) the odbc_result_all     function. (CVE-2007-0909)

  - Unspecified vulnerability in PHP before 5.2.1 allows     attackers to 'clobber' certain super-global variables     via unspecified vectors. (CVE-2007-0910)

  - Off-by-one error in the str_ireplace function in PHP     5.2.1 might allow context-dependent attackers to cause a     denial of service (crash). (CVE-2007-0911)

  - PHP 5.2.0 and 4.4 allows local users to bypass safe_mode     and open_basedir restrictions via a malicious path and a     null byte before a ';' in a session_save_path argument,     followed by an allowed path, which causes a parsing     inconsistency in which PHP validates the allowed path     but sets session.save_path to the malicious path. And     another fix for open_basedir was added to stop mixing up     its setting in a virtual host environment.
    (CVE-2006-6383)

バナーによると、リモートホストにインストールされている PHP のバージョンは、5.2.1 より前です。このようなバージョンは、バッファオーバーフロー、フォーマット文字列の脆弱性、任意のコードの実行、「safe_mode」および「open_basedir」のバイパス、スーパーグローバルの上書きによるデータ破壊など、いくつかの問題の影響を受けることがあります。

CVE-2007-0906: Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and (10) ibase_modify_user functions.

CVE-2007-0907: Buffer underflow in PHP before 5.2.1 allows attackers to cause a denial of service via unspecified vectors involving the sapi_header_op function.

CVE-2007-0908: The wddx extension in PHP before 5.2.1 allows remote attackers to obtain sensitive information via unspecified vectors.

CVE-2007-0909: Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.

CVE-2007-0910: Unspecified vulnerability in PHP before 5.2.1 allows attackers to 'clobber' certain super-global variables via unspecified vectors.

CVE-2007-0911: Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).

CVE-2006-6383: PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ';' in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path. And another fix for open_basedir was added to stop mixing up its setting in a virtual host environment.

根据其标题，远程主机上安装的 PHP 版本早于 5.2.1。此类版本可能受到多个问题的影响，包括缓冲区溢出、格式字符串漏洞、任意代码执行、“safe_mode”和“open_basedir”绕过以及 super-global 重写。

根據其標題，遠端主機上安裝的 PHP 版本舊於 5.2.1。這些版本可能會受到多個問題的影響，包括緩衝區溢位、格式字串弱點、任意程式碼執行、「safe_mode」和「open_basedir」略過，以及超全域記憶體區域。

The remote host is running PHP less than 5.2.0.  This version is vulnerable to around 180 bugs.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	名稱	產品	系列	已發布	已更新	嚴重性
24651	Mandrake Linux Security Advisory : php (MDKSA-2007:038)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	high
24907	PHP < 5.2.1 Multiple Vulnerabilities	Nessus	CGI abuses	2007/4/2	2024/5/28	high
29377	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 2684)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	critical
24907	PHP < 5.2.1 の複数の脆弱性	Nessus	CGI abuses	2007/4/2	2024/5/28	high
27390	openSUSE 10 Security Update : php5 (php5-2687)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	critical
24907	PHP < 5.2.1 多种漏洞	Nessus	CGI abuses	2007/4/2	2024/5/28	high
24907	PHP < 5.2.1 多種弱點	Nessus	CGI abuses	2007/4/2	2024/5/28	high
3857	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2007/2/9	2019/3/6	medium
801112	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			high

偵測

搜尋 Plugin

high

high

critical

high

critical

high

high

medium

high