CERT-In Advisory
CIAD-2013-0091
Multiple Vulnerabilities in PHP
Original Issue Date: December 17, 2013
Severity Rating: High
Systems Affected
- PHP versions prior to 5.3.28, 5.4.23, 5.5.7
Overview
Multiple vulnerabilities have been reported in PHP which could be exploited by remote attacker to execute arbitrary code and cause denial of service (DoS) conditions.
Description
1. Memory Corruption Vulnerability in PHP openssl_x509_parse() function
(
CVE-2013-6420
)
This vulnerability exists in a helper function asn1_time_to_time_t() in ext/openssl/openssl.c in PHP function openssl_x509_parse(). The parser within this helper function is not binary safe and can be tricked to write up to five NUL bytes outside of allocated buffer. A remote attacker could exploit this vulnerability via a specially crafted certificate to execute arbitrary code on the targeted system, which on failing could result in denial of service.
2. Heap-based Buffer Overflow Vulnerability in PHP parse_iso_intervals.c
(
CVE-2013-6712
)
This vulnerability exists in scan function in ext/date/lib/parse_iso_intervals.c in PHP due to improper restriction on the creation of Date Interval objects. A remote attacker could exploit this vulnerability via a crafted interval specification to cause denial of service conditions.
Solution
Upgrade to the latest versions(5.3.28, 5.4.23, 5.5.7) or apply source code fix as mentioned
http://git.php.net/?p=phpsrc.git;a=commit;h=c1224573c773b6845e83505f717fbf820fc18415
http://git.php.net/?p=phpsrc.git;a=commit;h=12fe4e90be7bfa2a763197079f68f5568a14e071
Vendor Information
PHP
http://www.php.net/
References
Ubuntu
http://www.ubuntu.com/usn/usn-2055-1/
Redhat
https://access.redhat.com/security/cve/CVE-2013-6420
https://access.redhat.com/security/cve/CVE-2013-6712
https://bugzilla.redhat.com/show_bug.cgi?id=1036830
Security Focus
http://www.securityfocus.com/bid/64225
http://www.securityfocus.com/bid/64018
Security Tracker
http://securitytracker.com/id/1029409
http://securitytracker.com/id/1029472
CVE Name
CVE-2013-6420
CVE-2013-6712
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|