Summary
The host is installed with PHP, that is prone to multiple vulnerabilities.
Impact
Successful exploitation could result in remote arbitrary code execution, security restrictions bypass, access to restricted files, denial of service.
Impact Level: System
Solution
Upgrade to PHP version 5.2.6 or above,
http://www.php.net/downloads.php
Insight
The flaws are caused by,
- an unspecified stack overflow error in FastCGI SAPI (fastcgi.c).
- an error during path translation in cgi_main.c.
- an error with an unknown impact/attack vectors.
- an unspecified error within the processing of incomplete multibyte characters in escapeshellcmd() API function.
- error in curl/interface.c in the cURL library(libcurl), which could be exploited by attackers to bypass safe_mode security restrictions.
- an error in PCRE. i.e buffer overflow error when handling a character class containing a very large number of characters with codepoints greater than 255(UTF-8 mode).
Affected
PHP version prior to 5.2.6
References
Severity
Classification
-
CVE CVE-2007-4850, CVE-2008-0599, CVE-2008-0674, CVE-2008-2050, CVE-2008-2051 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities