Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.870591
Category:Red Hat Local Security Checks
Title:RedHat Update for php53 RHSA-2012:0547-01
Summary:The remote host is missing an update for the 'php53'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'php53'
package(s) announced via the referenced advisory.

Vulnerability Insight:
PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Server.

A flaw was found in the way the php-cgi executable processed command line
arguments when running in CGI mode. A remote attacker could send a
specially-crafted request to a PHP script that would result in the query
string being parsed by php-cgi as command line options and arguments. This
could lead to the disclosure of the script's source code or arbitrary code
execution with the privileges of the PHP interpreter. (CVE-2012-1823)

Red Hat is aware that a public exploit for this issue is available that
allows remote code execution in affected PHP CGI configurations. This flaw
does not affect the default configuration using the PHP module for Apache
httpd to handle PHP scripts.

All php53 users should upgrade to these updated packages, which contain a
backported patch to resolve this issue. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

Affected Software/OS:
php53 on Red Hat Enterprise Linux (v. 5 server)

Solution:
Please Install the Updated Packages.

CVSS Score:
7.5

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2012-1823
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
CERT/CC vulnerability note: VU#520827
http://www.kb.cert.org/vuls/id/520827
CERT/CC vulnerability note: VU#673343
http://www.kb.cert.org/vuls/id/673343
Debian Security Information: DSA-2465 (Google Search)
http://www.debian.org/security/2012/dsa-2465
HPdes Security Advisory: HPSBMU02786
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
HPdes Security Advisory: HPSBUX02791
http://marc.info/?l=bugtraq&m=134012830914727&w=2
HPdes Security Advisory: SSRT100856
HPdes Security Advisory: SSRT100877
http://www.mandriva.com/security/advisories?name=MDVSA-2012:068
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
RedHat Security Advisories: RHSA-2012:0546
http://rhn.redhat.com/errata/RHSA-2012-0546.html
RedHat Security Advisories: RHSA-2012:0547
http://rhn.redhat.com/errata/RHSA-2012-0547.html
RedHat Security Advisories: RHSA-2012:0568
http://rhn.redhat.com/errata/RHSA-2012-0568.html
RedHat Security Advisories: RHSA-2012:0569
http://rhn.redhat.com/errata/RHSA-2012-0569.html
RedHat Security Advisories: RHSA-2012:0570
http://rhn.redhat.com/errata/RHSA-2012-0570.html
http://www.securitytracker.com/id?1027022
http://secunia.com/advisories/49014
http://secunia.com/advisories/49065
http://secunia.com/advisories/49085
http://secunia.com/advisories/49087
SuSE Security Announcement: SUSE-SU-2012:0598 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html
SuSE Security Announcement: SUSE-SU-2012:0604 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html
SuSE Security Announcement: openSUSE-SU-2012:0590 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html
CopyrightCopyright (c) 2012 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.