According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.28. It is, therefore, affected by multiple vulnerabilities :
Multiple use-after-free errors exist in spl_array.c, spl_observer.c, and spl_dllist.c due to improper sanitization of input to the unserialize() function. An attacker can exploit these issues, by using a specially crafted SplDoublyLinkedList, SplArrayObject, or SplObjectStorage object, to deference freed memory and thus execute arbitrary code. (CVE-2015-6831)
A dangling pointer error exists in file spl_array.c due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplDoublyLinkedList object, to gain control over a deallocated pointer and thus execute arbitrary code. (CVE-2015-6832)
A path traversal flaw exists in file phar_object.c due to improper sanitization of user-supplied input. An attacker can exploit this to write arbitrary files.
(CVE-2015-6833)
A type confusion flaw exists in the serialize_function_call() function in soap.c due to improper validation of input passed via the header field. A remote attacker can exploit this to execute arbitrary code. (CVE-2015-6836)
Multiple type confusion flaws exist in the _call() method in file php_http.c when handling calls for zend_hash_get_current_key or ‘Z*’. An attacker can exploit this to disclose memory contents or crash an application using PHP. (CVE-2015-8835)
The openssl_random_pseudo_bytes() function in file openssl.c does not generate sufficiently random numbers.
This allows an attacker to more easily predict the results, thus allowing further attacks to be carried out. (CVE-2015-8867)
A flaw exists in file zend_exceptions.c due to the improper use of the function unserialize() during recursive method calls. A remote attacker can exploit this to crash an application using PHP. (CVE-2015-8873)
A flaw exists in file zend_exceptions.c due to insufficient type checking by functions unserialize() and __toString(). A remote attacker can exploit this to cause a NULL pointer deference or unexpected method execution, thus causing an application using PHP to crash. (CVE-2015-8876)
An integer truncation flaw exists in the zend_hash_compare() function in zend_hash.c that is triggered when comparing arrays. A remote attacker can exploit this to cause arrays to be improperly matched during comparison.
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(85299);
script_version("1.17");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");
script_cve_id(
"CVE-2015-6831",
"CVE-2015-6832",
"CVE-2015-6833",
"CVE-2015-6836",
"CVE-2015-8835",
"CVE-2015-8867",
"CVE-2015-8873",
"CVE-2015-8876"
);
script_xref(name:"EDB-ID", value:"38304");
script_name(english:"PHP 5.5.x < 5.5.28 Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"The remote web server uses a version of PHP that is affected by
multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"According to its banner, the version of PHP running on the remote web
server is 5.5.x prior to 5.5.28. It is, therefore, affected by
multiple vulnerabilities :
- Multiple use-after-free errors exist in spl_array.c,
spl_observer.c, and spl_dllist.c due to improper
sanitization of input to the unserialize() function. An
attacker can exploit these issues, by using a specially
crafted SplDoublyLinkedList, SplArrayObject, or
SplObjectStorage object, to deference freed memory and
thus execute arbitrary code. (CVE-2015-6831)
- A dangling pointer error exists in file spl_array.c due
to improper sanitization of input to the unserialize()
function. An attacker can exploit this, by using a
specially crafted SplDoublyLinkedList object, to gain
control over a deallocated pointer and thus execute
arbitrary code. (CVE-2015-6832)
- A path traversal flaw exists in file phar_object.c due
to improper sanitization of user-supplied input. An
attacker can exploit this to write arbitrary files.
(CVE-2015-6833)
- A type confusion flaw exists in the
serialize_function_call() function in soap.c due to
improper validation of input passed via the header
field. A remote attacker can exploit this to execute
arbitrary code. (CVE-2015-6836)
- Multiple type confusion flaws exist in the _call()
method in file php_http.c when handling calls for
zend_hash_get_current_key or 'Z*'. An attacker can
exploit this to disclose memory contents or crash
an application using PHP. (CVE-2015-8835)
- The openssl_random_pseudo_bytes() function in file
openssl.c does not generate sufficiently random numbers.
This allows an attacker to more easily predict the
results, thus allowing further attacks to be carried
out. (CVE-2015-8867)
- A flaw exists in file zend_exceptions.c due to the
improper use of the function unserialize() during
recursive method calls. A remote attacker can exploit
this to crash an application using PHP. (CVE-2015-8873)
- A flaw exists in file zend_exceptions.c due to
insufficient type checking by functions unserialize()
and __toString(). A remote attacker can exploit this to
cause a NULL pointer deference or unexpected method
execution, thus causing an application using PHP to
crash. (CVE-2015-8876)
- An integer truncation flaw exists in the
zend_hash_compare() function in zend_hash.c that is
triggered when comparing arrays. A remote attacker can
exploit this to cause arrays to be improperly matched
during comparison.
Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
script_set_attribute(attribute:"see_also", value:"http://php.net/ChangeLog-5.php#5.5.28");
script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2015/Aug/17");
script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2015/Aug/18");
script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2015/Aug/19");
script_set_attribute(attribute:"see_also", value:"https://bugs.php.net/bug.php?id=69793");
script_set_attribute(attribute:"see_also", value:"https://bugs.php.net/bug.php?id=70121");
script_set_attribute(attribute:"solution", value:
"Upgrade to PHP version 5.5.28 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-8876");
script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2015/06/10");
script_set_attribute(attribute:"patch_publication_date", value:"2015/08/06");
script_set_attribute(attribute:"plugin_publication_date", value:"2015/08/11");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
script_set_attribute(attribute:"thorough_tests", value:"true");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CGI abuses");
script_copyright(english:"This script is Copyright (C) 2015-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("php_version.nasl");
script_require_keys("www/PHP");
script_require_ports("Services/www", 80);
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");
port = get_http_port(default:80, php:TRUE);
php = get_php_from_kb(
port : port,
exit_on_fail : TRUE
);
version = php["ver"];
source = php["src"];
backported = get_kb_item('www/php/'+port+'/'+version+'/backported');
if (report_paranoia < 2 && backported) audit(AUDIT_BACKPORT_SERVICE, port, "PHP "+version+" install");
# Check that it is the correct version of PHP
if (version =~ "^5(\.5)?$") audit(AUDIT_VER_NOT_GRANULAR, "PHP", port, version);
if (version !~ "^5\.5\.") audit(AUDIT_NOT_DETECT, "PHP version 5.5.x", port);
if (version =~ "^5\.5\.([0-9]|1[0-9]|2[0-7])($|[^0-9])")
{
if (report_verbosity > 0)
{
report =
'\n Version source : ' + source +
'\n Installed version : ' + version +
'\n Fixed version : 5.5.28' +
'\n';
security_hole(port:port, extra:report);
}
else security_hole(port);
exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, "PHP", port, version);
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6831
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6832
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6833
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6836
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8835
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8867
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8873
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8876
php.net/ChangeLog-5.php#5.5.28
bugs.php.net/bug.php?id=69793
bugs.php.net/bug.php?id=70121
seclists.org/fulldisclosure/2015/Aug/17
seclists.org/fulldisclosure/2015/Aug/18
seclists.org/fulldisclosure/2015/Aug/19