|
|
Family: CGI abuses --> Category: infos
PHP < 4.4.1 / 5.0.6 Multiple Vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
Checks for multiple vulnerabilities in PHP < 4.4.1 / 5.0.6
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server uses a version of PHP that is affected by
multiple flaws.
Description :
According to its banner, the version of PHP installed on the remote
host is older than 4.4.1 or 5.0.6. Such versions fail to protect the
'$GLOBALS' superglobals variable from being overwritten due to
weaknesses in the file upload handling code as well as the 'extract()'
and 'import_request_variables()' functions. Depending on the nature
of the PHP applications on the affected host, exploitation of this
issue may lead to any number of attacks, including arbitrary code
execution.
In addition, these versions may enable a possible hacker to exploit an
integer overflow flaw in certain certain versions of the PCRE library,
to enable PHP's 'register_globals' setting even if explicitly disabled
in the configuration, and to launch cross-site scripting attacks
involving PHP's 'phpinfo()' function.
See also :
http://www.hardened-php.net/advisory_182005.77.html
http://www.hardened-php.net/advisory_182005.78.html
http://www.hardened-php.net/advisory_202005.79.html
http://www.php.net/release_4_4_1.php
Solution :
Upgrade to PHP version 4.4.1 / 5.0.6 or later.
Threat Level:
Medium / CVSS Base Score : 6
(AV:R/AC:H/Au:NR/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
