| VID |
22305 |
| Severity |
30 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
WWW |
| Detailed Description |
The Web server is running a version of PHP which is older than 5.0.2.
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. PHP versions 4.2.0 through 5.0.1 are vulnerable to a memory disclosure vulnerability, caused by a vulnerability in the array parsing functions of the 'php_variables.c' PHP source file. By sending a specially-crafted HTTP request to the phpinfo.php script that appends a GET, POST, or COOKIE variable array, a remote attacker could read portions of the memory of the httpd process on the affected host.
* Note: This check solely relied on the banner of the remote Web server to assess this vulnerability, so this might be a false positive.
* References:
http://www.php.net/ChangeLog-5.php#5.0.2
http://www.securitytracker.com/alerts/2004/Sep/1011279.html
http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0053.html
* Platforms Affected:
PHP 4.2.0 through 5.0.1
Any operating system Any version |
| Recommendation |
Upgrade to the latest version of PHP (5.0.2 or later), available from the PHP Web site at http://www.php.net
-- OR --
For PHP 5.0.1:
Apply the patch for this vulnerability, available from the PHP Web site at http://chora.php.net/php-src/main/php_variables.c |
| Related URL |
CVE-2004-0958 (CVE) |
| Related URL |
11334 (SecurityFocus) |
| Related URL |
17393 (ISS) |
|
