PHP 'openssl_encrypt()' Function Information Disclosure Vulnerability (Win)

  1. Network Vulnerabilities
  2. Web application abuses
  3. PHP 'openssl_encrypt()' Function Information Disclosure Vulnerability (Win)
Summary
This host is installed with PHP and is prone to information disclosure vulnerability
Impact
Successful exploitation will allow remote attackers to obtain sensitive information from process memory by providing zero bytes of input data. Impact Level: Application
Solution
Apply patch or upgrade latest version, http://www.php.net/downloads.php https://bugs.php.net/bug.php?id=61413 ***** NOTE: Ignore this warning, if above mentioned patch is manually applied. *****
Insight
The flaw is due to error in 'openssl_encrypt()' function when handling empty $data strings which will allow an attacker to gain access to arbitrary pieces of information in current memory.
Affected
PHP version 5.3.9 through 5.3.13 on windows
References
Updated on 2015-03-25
Severity
Medium Severity
Classification
Related Vulnerabilities