The PHP development team reports :

- Added missing safe_mode/open_basedir checks inside the error_log(), file_exists(), imap_open() and imap_reopen() functions.

- Fixed overflows inside str_repeat() and wordwrap() functions on 64bit systems.

- Fixed possible open_basedir/safe_mode bypass in cURL extension and with realpath cache.

- Fixed overflow in GD extension on invalid GIF images.

- Fixed a buffer overflow inside sscanf() function.

- Fixed an out of bounds read inside stripos() function.

- Fixed memory_limit restriction on 64 bit system.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.1.5.  Such versions may be affected by the following vulnerabilities :

  - The c-client library 2000, 2001, or 2004 for PHP does     not check the safe_mode or open_basedir functions.
    (CVE-2006-1017)

  - A buffer overflow exists in the sscanf function.
    (CVE-2006-4020)

  - The file_exists and imap_reopen functions do not check     for the safe_mode and open_basedir settings, which     allows local users to bypass the settings.     (CVE-2006-4481)

  - Multiple heap-based buffer overflows exist in the     str_repeat and wordwrap functions in     ext/standard/string.c. (CVE-2006-4482)

  - The cURL extension files permit the     CURLOPT_FOLLOWLOCATION option when open_basedir or     safe_mode is enabled, which allows attackers to perform     unauthorized actions. (CVE-2006-4483)

  - A buffer overflow vulnerability exists in the     LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the     GD extension. (CVE-2006-4484)

  - The stripos function is affected by an out-of-bounds     read. (CVE-2006-4485)

The stripos() function did not check for invalidly long or empty haystack strings. In an application that uses this function on arbitrary untrusted data this could be exploited to crash the PHP interpreter. (CVE-2006-4485)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly. A remote attacker could exploit this to cause a Denial of Service attack through memory exhaustion. (CVE-2006-4486)

Maksymilian Arciemowicz discovered that security relevant configuration options like open_basedir and safe_mode (which can be configured in Apache's httpd.conf) could be bypassed and reset to their default value in php.ini by using the ini_restore() function.
(CVE-2006-4625)

Stefan Esser discovered that the ecalloc() function in the Zend engine did not check for integer overflows. This particularly affected the unserialize() function. In applications which unserialize untrusted user-defined data, this could be exploited to execute arbitrary code with the application's privileges. (CVE-2006-4812).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings (CVE-2006-4481).

Buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array (CVE-2006-4484).

The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read (CVE-2006-4485).

CVE-2006-4485 does not affect the Corporate3 or MNF2 versions of PHP.

Updated packages have been patched to correct these issues.

バナーによると、リモートホストにインストールされているPHP 5.xのバージョンは5.1.5より前です。このようなバージョンは、以下の脆弱性の影響を受ける可能性があります：

  - PHP の c-client ライブラリ 2000、2001、または 2004 は、safe_mode 関数または open_basedir 関数を確認しません。
    （CVE-2006-1017）

  - sscanf 関数にバッファオーバーフローがあります。
    （CVE-2006-4020）

  - file_existsおよびimap_reopen関数が、safe_modeおよびopen_basedir settingsをチェックしないために、ローカルユーザーが設定をバイパスする可能性があります。（CVE-2006-4481）

  - ext/standard/string.cの中のstr_repeatおよびwordwrap関数に、複数のヒープベースのバッファオーバーフローが存在します。（CVE-2006-4482）

  - open_basedirまたはsafe_modeを有効にした際に、cURL拡張ファイルによりCURLOPT_FOLLOWLOCATIONオプションが許可され、攻撃者が認証されていない操作を実行する可能性があります。（CVE-2006-4483）

  - GD拡張のext/gd/libgd/gd_gif_in.cのLWZReadByte_関数に、バッファオーバーフローの脆弱性が存在します。（CVE-2006-4484）

  - stripos関数が領域外読み取りの影響を受けます。（CVE-2006-4485）

根据其标题，远程主机上安装的 PHP 5.x 版本早于 5.1.5。这些版本可能受到以下漏洞影响：

- 用于 PHP 的 c-client 库 2000、2001 或 2004 不会检查 safe_mode 或 open_basedir 函数。
 (CVE-2006-1017)

- sscanf 函数中存在缓冲区溢出。
 (CVE-2006-4020)

- file_exists 和 imap_reopen 函数未检查 safe_mode 和 open_basedir 设置，这可允许本地用户绕过设置。(CVE-2006-4481)

- ext/standard/string.c 的 str_repeat 和 wordwrap 函数中存在多个基于堆的缓冲区溢出。(CVE-2006-4482)

- 在 open_basedir 或 safe_mode 已启用的情况下 cURL 扩展文件允许 CURLOPT_FOLLOWLOCATION 选项，这可允许攻击者执行未经授权的操作。(CVE-2006-4483)

- 在 GD 扩展内，ext/gd/libgd/gd_gif_in.c 的 LWZReadByte_ 函数中存在一个缓冲区溢出漏洞。(CVE-2006-4484)

- stripos 函数受到一个越界读取错误影响。(CVE-2006-4485)

根據其標題，遠端主機上安裝的 PHP 5.x 版本比 5.1.5 舊。這些版本可能受到以下弱點影響：

- PHP 版 c-client 程式庫 2000、2001 或 2004 未檢查 safe_mode 或 open_basedir 函式。
 (CVE-2006-1017)

- sscanf 函式中存在一個緩衝區溢位問題。
 (CVE-2006-4020)

- file_exists 和 imap_reopen 函式未檢查 safe_mode 和 open_basedir 設定，這可允許本機使用者繞過設定。(CVE-2006-4481)

- ext/standard/string.c 的 str_repeat 和 wordwrap 函式中存在多個堆積型緩衝區溢位問題。(CVE-2006-4482)

- 在 open_basedir 或 safe_mode 已啟用的情況下，cURL 延伸模組檔案允許 CURLOPT_FOLLOWLOCATION 選項，這可允許攻擊者執行未經授權的動作。(CVE-2006-4483)

- 在 GD 延伸模組內，ext/gd/libgd/gd_gif_in.c 的 LWZReadByte_ 函式中存在一個緩衝區溢位弱點。(CVE-2006-4484)

- stripos 函式受到一個超出邊界讀取錯誤影響。(CVE-2006-4485)

The remote host is running a version of PHP that is older than 4.4.4 or 5.1.5.  This version is reported vulnerable to several flaws that may allow an attacker with the right to execute PHP scripts the ability to execute arbitrary code.  Executed code would be run with the permissions of the web server process. 

ID	名前	製品	ファミリー	公開日	更新日	深刻度
22343	FreeBSD : php -- multiple vulnerabilities (ea09c5df-4362-11db-81e1-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	2006/9/14	2021/1/6	critical
17713	PHP 5.1.x < 5.1.5 Multiple Vulnerabilities	Nessus	CGI abuses	2011/11/18	2024/5/31	critical
27942	Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-362-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	critical
23906	Mandrake Linux Security Advisory : php (MDKSA-2006:162)	Nessus	Mandriva Local Security Checks	2006/12/16	2021/1/6	critical
17713	PHP 5.1.x < 5.1.5の複数の脆弱性	Nessus	CGI abuses	2011/11/18	2024/5/31	critical
17713	PHP 5.1.x < 5.1.5 多种漏洞	Nessus	CGI abuses	2011/11/18	2024/5/31	critical
17713	PHP 5.1.x < 5.1.5 多個弱點	Nessus	CGI abuses	2011/11/18	2024/5/31	critical
3732	PHP 4.x < 4.4.4 / 5.x < 5.1.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2006/10/12	2019/3/6	medium
801073	PHP < 4.4.4 / 5.1.4 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			high

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

medium

high