Anfälligkeitssuche        Suche in 219043 CVE Beschreibungen
und 99761 Test Beschreibungen,
Zugriff auf 10,000+ Quellverweise.
Tests   CVE   Alle  

Test Kennung:1.3.6.1.4.1.25623.1.0.59175
Kategorie:Ubuntu Local Security Checks
Titel:Ubuntu USN-485-1 (php5)
Zusammenfassung:NOSUMMARY
Beschreibung:Description:

The remote host is missing an update to php5
announced via advisory USN-485-1.

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

Details follow:

It was discovered that the PHP xmlrpc extension did not correctly check
heap memory allocation sizes. A remote attacker could send a specially
crafted request to a PHP application using xmlrpc and execute arbitrary
code as the Apache user. (CVE-2007-1864)

Stefan Esser discovered a flaw in the random number initialization of the
PHP SOAP extension. This could lead to remote attackers being able to
predict certain elements of the authentication mechanism. (CVE-2007-2728)

Solution:
The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
libapache2-mod-php5 5.1.2-1ubuntu3.9
php5-xmlrpc 5.1.2-1ubuntu3.9

Ubuntu 6.10:
libapache2-mod-php5 5.1.6-1ubuntu2.6
php5-xmlrpc 5.1.6-1ubuntu2.6

Ubuntu 7.04:
libapache2-mod-php5 5.2.1-0ubuntu1.4
php5-xmlrpc 5.2.1-0ubuntu1.4

In general, a standard system upgrade is sufficient to effect the
necessary changes.

http://www.securityspace.com/smysecure/catid.html?in=USN-485-1

Risk factor : High

CVSS Score:
7.5

Querverweis: Common Vulnerability Exposure (CVE) ID: CVE-2007-1864
BugTraq ID: 23813
http://www.securityfocus.com/bid/23813
Debian Security Information: DSA-1330 (Google Search)
http://www.debian.org/security/2007/dsa-1330
Debian Security Information: DSA-1331 (Google Search)
http://www.debian.org/security/2007/dsa-1331
http://security.gentoo.org/glsa/glsa-200705-19.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:102
http://www.mandriva.com/security/advisories?name=MDKSA-2007:103
http://osvdb.org/34674
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11257
RedHat Security Advisories: RHSA-2007:0348
https://rhn.redhat.com/errata/RHSA-2007-0348.html
http://www.redhat.com/support/errata/RHSA-2007-0349.html
http://www.redhat.com/support/errata/RHSA-2007-0355.html
http://www.securitytracker.com/id?1018024
http://secunia.com/advisories/25187
http://secunia.com/advisories/25191
http://secunia.com/advisories/25255
http://secunia.com/advisories/25445
http://secunia.com/advisories/25660
http://secunia.com/advisories/25938
http://secunia.com/advisories/25945
http://secunia.com/advisories/26048
http://secunia.com/advisories/26102
http://secunia.com/advisories/27377
SuSE Security Announcement: SUSE-SA:2007:044 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
http://www.trustix.org/errata/2007/0017/
http://www.ubuntu.com/usn/usn-485-1
http://www.vupen.com/english/advisories/2007/2187
Common Vulnerability Exposure (CVE) ID: CVE-2007-2728
http://www.mandriva.com/security/advisories?name=MDKSA-2007:187
http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html
http://osvdb.org/36086
http://secunia.com/advisories/25306
http://secunia.com/advisories/26895
SuSE Security Announcement: SUSE-SR:2007:015 (Google Search)
http://www.novell.com/linux/security/advisories/2007_15_sr.html
http://www.vupen.com/english/advisories/2007/1839
CopyrightCopyright (c) 2007 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.

Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.




© 1998-2024 E-Soft Inc. Alle Rechte vorbehalten.