SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PHP Vendors:   PHP Group
PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code
SecurityTracker Alert ID:  1027022
SecurityTracker URL:  http://securitytracker.com/id/1027022
CVE Reference:   CVE-2012-1823, CVE-2012-2311   (Links to External Site)
Updated:  May 28 2012
Original Entry Date:  May 4 2012
Impact:   Disclosure of system information, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): prior to 5.3.12 and 5.4.2
Description:   A vulnerability was reported in PHP. A remote user can obtain potentially sensitive information. A remote user can execute arbitrary code on the target system.

A remote user can submit a specially crafted request containing a command line switch to cause the php-cgi binary to execute the parameter.

Systems where PHP is used in a CGI-based setup (e.g., Apache mod_cgi) may be affected.

Systems using Apache mod_php or nginx with php-fpm are not affected.

A demonstration exploit URL is provided:

http://[target]/index.php?-s

This vulnerability is being actively exploited.

The original advisory is available at:

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

De Eindbazen reported this vulnerability.

Impact:   A remote user can obtain potentially sensitive information.

A remote user can execute arbitrary code on the target system.

Solution:   The vendor issued a fix (5.3.12, 5.4.2) for CVE-2012-1823. It was later determined that the fix does not fully correct the vulnerability [CVE-2012-2311].

The vendor has issued a fix (5.3.13, 5.4.3) for CVE-2012-2311.

The vendor's original advisory is available at:

http://www.php.net/archive/2012.php#id2012-05-03-1

Vendor URL:  www.php.net/archive/2012.php#id2012-05-03-1 (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 7 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code
Red Hat has issued a fix for Red Hat Enterprise Linux 5 and 6.
May 7 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code
Red Hat has issued a fix for Red Hat Enterprise Linux 5.
May 10 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code
Red Hat has issued a fix for Red Hat Enterprise Linux 5.6.
May 10 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code
Red Hat has issued a fix for Red Hat Enterprise Linux 5.3, 5.6, 6.0, and 6.1.
May 11 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code
Red Hat has issued a fix for Red Hat Application Stack v2.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC