Vulnerability Assessment & Network Security Forums
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.
Vulnerability Assessment Details
Check for the version of the php package
Detailed Explanation for this Vulnerability Assessment
The remote host is missing the patch for the advisory MDKSA-2005:213 (php).
A number of vulnerabilities were discovered in PHP: An issue with
fopen_wrappers.c would not properly restrict access to other directories when
the open_basedir directive included a trailing slash (CVE-2005-3054)
issue does not affect Corporate Server 2.1. An issue with the apache2handler
SAPI in mod_php could permit a possible hacker to cause a Denial of Service via the
session.save_path option in an .htaccess file or VirtualHost stanza
this issue does not affect Corporate Server 2.1. A Denial of
Service vulnerability was discovered in the way that PHP processes EXIF image
data which could permit a possible hacker to cause PHP to crash by supplying carefully
crafted EXIF image data (CVE-2005-3353). A cross-site scripting vulnerability
was discovered in the phpinfo() function which could permit for the injection of
data such as cookies (CVE-2005-3388). A flaw in the parse_str() function could
permit for the enabling of register_globals, even if it was disabled in the PHP
configuration file (CVE-2005-3389). A vulnerability in the way that PHP
registers global variables during a file upload request could permit a remote
attacker to overwrite the $GLOBALS array which could potentially lead the
execution of arbitrary PHP commands. This vulnerability only affects systems
with register_globals enabled (CVE-2005-3390). The updated packages have been
patched to address this issue. Once the new packages have been installed, you
will need to restart your Apache server using 'service httpd restart' in order
for the new packages to take effect ('service httpd2-naat restart' for MNF2).
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:213
Network Security Threat Level: High
Networks Security ID:
Vulnerability Assessment Copyright: This script is Copyright (C) 2006 Tenable Network Security
|Dell Brocade 6510 48-Port 16Gb Fibre Channel Switch Reverse Air w/24x 8Gb SFP
|Dell 358VV Force10 SFP+5M Twinax SFP Port Cable Heavy Duty Connector
|Lot of Genuine CISCO Plug-in Transceiver Module SFP-10G-LRM nice working pulls.
|WTD RTXM191-400 1.25G-1310NM-10KM-SM-ESFP SFP Transceiver Module 20 pcs. / lot
No Discussions have been posted on this vulnerability.