{"published": "2004-09-15T00:00:00", "type": "freebsd", "references": ["http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492"], "modified": "2004-09-15T00:00:00", "description": "\nStefano Di Paola reports:\n\nBad array parsing in php_variables.c could lead to show\n\t arbitrary memory content such as pieces of php code\n\t and other data. This affects all GET, POST or COOKIES\n\t variables.\n\n", "enchantments": {"score": {"value": 4.0, "vector": "NONE", "modified": "2016-09-26T17:25:20"}, "dependencies": {"references": [{"type": "nessus", "idList": ["FREEBSD_PKG_AD74A1BD16D211D9BC4A000C41E2CDAD.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:52359"]}], "modified": "2016-09-26T17:25:20"}, "vulnersScore": 4.0}, "id": "AD74A1BD-16D2-11D9-BC4A-000C41E2CDAD", "hash": "f10d3902f715bf2f11ae990467ba537d50bbdb253419a4b0e61a95480d6e70c6", "hashmap": [{"hash": "6776a8e2fa21ffaef52aca32c1d838e3", "key": "affectedPackage"}, {"hash": "4913a9178621eadcdf191db17915fbcb", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "9323465778ea48b41ce3442a3c127e4b", "key": "description"}, {"hash": "44f79194b65fc3e57cee8a49c17c7f8e", "key": "href"}, {"hash": "5fc6166254a9d850b27783380800b4fe", "key": "modified"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "5fc6166254a9d850b27783380800b4fe", "key": "published"}, {"hash": "38ecce0381d10e0b2a828b0bde33a0b2", "key": "references"}, {"hash": "a3dc630729e463135f4e608954fa6e19", "key": "reporter"}, {"hash": "bc6a5631bc055e9844018ccfb6807583", "key": "title"}, {"hash": "1527e888767cdce15d200b870b39cfd0", "key": "type"}, {"hash": "cfcd208495d565ef66e7dff9f98764da", "key": "viewCount"}], "edition": 1, "affectedPackage": [{"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php4-cgi"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4", "arch": "noarch", "OS": "FreeBSD", "operator": "eq", "packageName": "mod_php"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "5.0.1", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php5-cgi"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php4-horde"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "5.0.1", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php5"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php4-nms"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2,1", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "mod_php"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php4"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "mod_php4-twig"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php4-dtc"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4", "arch": "noarch", "OS": "FreeBSD", "operator": "eq", "packageName": "mod_php4"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "5.0.1", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php5-cli"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2,1", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "mod_php4"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "4.3.8_2", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "php4-cli"}, {"OSVersion": "any", "packageFilename": "UNKNOWN", "packageVersion": "5.0.1,1", "arch": "noarch", "OS": "FreeBSD", "operator": "le", "packageName": "mod_php5"}], "bulletinFamily": "unix", "reporter": "FreeBSD", "title": "php -- php_variables memory disclosure", "viewCount": 0, "lastseen": "2016-09-26T17:25:20", "cvelist": [], "objectVersion": "1.2", "history": [], "href": "https://vuxml.freebsd.org/freebsd/ad74a1bd-16d2-11d9-bc4a-000c41e2cdad.html", "cvss": {"score": 0.0, "vector": "NONE"}}

{"nessus": [{"lastseen": "2019-02-21T01:11:42", "bulletinFamily": "scanner", "description": "Stefano Di Paola reports :\n\nBad array parsing in php_variables.c could lead to show arbitrary memory content such as pieces of php code and other data. This affects all GET, POST or COOKIES variables.", "modified": "2018-11-23T00:00:00", "id": "FREEBSD_PKG_AD74A1BD16D211D9BC4A000C41E2CDAD.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=36848", "published": "2009-04-23T00:00:00", "title": "FreeBSD : php -- php_variables memory disclosure (ad74a1bd-16d2-11d9-bc4a-000c41e2cdad)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(36848);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2018/11/23 12:49:57\");\n\n script_name(english:\"FreeBSD : php -- php_variables memory disclosure (ad74a1bd-16d2-11d9-bc4a-000c41e2cdad)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Stefano Di Paola reports :\n\nBad array parsing in php_variables.c could lead to show arbitrary\nmemory content such as pieces of php code and other data. This affects\nall GET, POST or COOKIES variables.\"\n );\n # http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://marc.info/?l=bugtraq&m=109527531130492\"\n );\n # https://vuxml.freebsd.org/freebsd/ad74a1bd-16d2-11d9-bc4a-000c41e2cdad.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?07e5e64f\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mod_php\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mod_php4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mod_php4-twig\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:mod_php5\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php4-cgi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php4-cli\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php4-dtc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php4-horde\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php4-nms\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php5\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php5-cgi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:php5-cli\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2004/09/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2004/10/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"mod_php4-twig<=4.3.8_2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php4-cgi<=4.3.8_2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php4-cli<=4.3.8_2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php4-dtc<=4.3.8_2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php4-horde<=4.3.8_2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php4-nms<=4.3.8_2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php4<=4.3.8_2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mod_php>=4<=4.3.8_2,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mod_php4>=4<=4.3.8_2,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php5<=5.0.1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php5-cgi<=5.0.1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"php5-cli<=5.0.1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"mod_php5<=5.0.1,1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "openvas": [{"lastseen": "2017-07-02T21:10:21", "bulletinFamily": "scanner", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2016-09-22T00:00:00", "published": "2008-09-04T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=52359", "id": "OPENVAS:52359", "title": "php -- php_variables memory disclosure", "type": "openvas", "sourceData": "#\n#VID ad74a1bd-16d2-11d9-bc4a-000c41e2cdad\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following packages are affected:\n mod_php4-twig, php4-cgi, php4-cli, php4-dtc, php4-horde,\n php4-nms, php4, mod_php, mod_php4, php5, php5-cgi,\n php5-cli, mod_php5\n\nThe installed version of PHP suffers from a vulnerability\nthat allows remote attackers to read sensitive memory\ncontents.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492\nhttp://www.vuxml.org/freebsd/ad74a1bd-16d2-11d9-bc4a-000c41e2cdad.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(52359);\n script_version(\"$Revision: 4128 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-22 07:37:51 +0200 (Thu, 22 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_bugtraq_id(11334);\n script_cve_id(\"CVE-2004-0958\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"php -- php_variables memory disclosure\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"mod_php4-twig\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.3.8_2\")<=0) {\n txt += 'Package mod_php4-twig version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php4-cgi\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.3.8_2\")<=0) {\n txt += 'Package php4-cgi version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php4-cli\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.3.8_2\")<=0) {\n txt += 'Package php4-cli version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php4-dtc\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.3.8_2\")<=0) {\n txt += 'Package php4-dtc version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php4-horde\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.3.8_2\")<=0) {\n txt += 'Package php4-horde version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php4-nms\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.3.8_2\")<=0) {\n txt += 'Package php4-nms version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php4\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.3.8_2\")<=0) {\n txt += 'Package php4 version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"mod_php\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4\")>=0 && revcomp(a:bver, b:\"4.3.8_2,1\")<=0) {\n txt += 'Package mod_php version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"mod_php4\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4\")>=0 && revcomp(a:bver, b:\"4.3.8_2,1\")<=0) {\n txt += 'Package mod_php4 version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php5\");\nif(!isnull(bver) && revcomp(a:bver, b:\"5.0.1\")<=0) {\n txt += 'Package php5 version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php5-cgi\");\nif(!isnull(bver) && revcomp(a:bver, b:\"5.0.1\")<=0) {\n txt += 'Package php5-cgi version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"php5-cli\");\nif(!isnull(bver) && revcomp(a:bver, b:\"5.0.1\")<=0) {\n txt += 'Package php5-cli version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\nbver = portver(pkg:\"mod_php5\");\nif(!isnull(bver) && revcomp(a:bver, b:\"5.0.1,1\")<=0) {\n txt += 'Package mod_php5 version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}]}