PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6 Multiple Vulnerabilities - Linux

# Copyright (C) 2021 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

CPE = "cpe:/a:php:php";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.117750");
  script_version("2021-10-25T12:03:22+0000");
  script_tag(name:"last_modification", value:"2021-10-25 12:03:22 +0000 (Mon, 25 Oct 2021)");
  script_tag(name:"creation_date", value:"2021-10-25 10:37:23 +0000 (Mon, 25 Oct 2021)");
  script_tag(name:"cvss_base", value:"6.4");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2020-10-16 12:57:00 +0000 (Fri, 16 Oct 2020)");

  script_cve_id("CVE-2019-11038", "CVE-2019-11039", "CVE-2019-11040");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("PHP 7.1.x < 7.1.30, 7.2.x < 7.2.19, 7.3.x < 7.3.6 Multiple Vulnerabilities - Linux");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2021 Greenbone Networks GmbH");
  script_family("Web application abuses");
  script_dependencies("gb_php_ssh_login_detect.nasl", "gb_php_http_detect.nasl", "os_detection.nasl");
  script_mandatory_keys("php/detected", "Host/runs_unixoide");

  script_tag(name:"summary", value:"PHP is prone to multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following flaws exist:

  - CVE-2019-11038: When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka
  LibGD) 2.2.5, as used in the PHP GD extension it is possible to supply data that will cause the
  function to use the value of uninitialized variable. This may lead to disclosing contents of the
  stack that has been left there by previous code.

  - CVE-2019-11039: Function iconv_mime_decode_headers() may perform out-of-buffer read due to
  integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

  - CVE-2019-11040: When PHP EXIF extension is parsing EXIF information from an image, e.g. via
  exif_read_data() function it is possible to supply it with data what will cause it to read past
  the allocated buffer. This may lead to information disclosure or crash.");

  script_tag(name:"affected", value:"PHP versions 7.1.x prior to 7.1.30, 7.2.x prior to 7.2.19 and
  7.3.x prior to 7.3.6.");

  script_tag(name:"solution", value:"Update to version 7.1.30, 7.2.19, 7.3.6 or later.");

  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.3.6");
  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.2.19");
  script_xref(name:"URL", value:"https://www.php.net/ChangeLog-7.php#7.1.30");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range(version: version, test_version: "7.1", test_version2: "7.1.29")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.1.30", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "7.2", test_version2: "7.2.18")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.2.19", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "7.3", test_version2: "7.3.5")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "7.3.6", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);