SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   PHP Vendors:   PHP Group
PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code
SecurityTracker Alert ID:  1027022
SecurityTracker URL:  http://securitytracker.com/id/1027022
CVE Reference:   CVE-2012-1823, CVE-2012-2311   (Links to External Site)
Updated:  May 28 2012
Original Entry Date:  May 4 2012
Impact:   Disclosure of system information, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): prior to 5.3.12 and 5.4.2
Description:   A vulnerability was reported in PHP. A remote user can obtain potentially sensitive information. A remote user can execute arbitrary code on the target system.

A remote user can submit a specially crafted request containing a command line switch to cause the php-cgi binary to execute the parameter.

Systems where PHP is used in a CGI-based setup (e.g., Apache mod_cgi) may be affected.

Systems using Apache mod_php or nginx with php-fpm are not affected.

A demonstration exploit URL is provided:

http://[target]/index.php?-s

This vulnerability is being actively exploited.

The original advisory is available at:

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

De Eindbazen reported this vulnerability.

Impact:   A remote user can obtain potentially sensitive information.

A remote user can execute arbitrary code on the target system.

Solution:   The vendor issued a fix (5.3.12, 5.4.2) for CVE-2012-1823. It was later determined that the fix does not fully correct the vulnerability [CVE-2012-2311].

The vendor has issued a fix (5.3.13, 5.4.3) for CVE-2012-2311.

The vendor's original advisory is available at:

http://www.php.net/archive/2012.php#id2012-05-03-1

Vendor URL:  www.php.net/archive/2012.php#id2012-05-03-1 (Links to External Site)
Cause:   Access control error
Underlying OS:   Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 7 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code   (bugzilla@redhat.com)
Red Hat has issued a fix for Red Hat Enterprise Linux 5 and 6.
May 7 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code   (bugzilla@redhat.com)
Red Hat has issued a fix for Red Hat Enterprise Linux 5.
May 10 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code   (bugzilla@redhat.com)
Red Hat has issued a fix for Red Hat Enterprise Linux 5.6.
May 10 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code   (bugzilla@redhat.com)
Red Hat has issued a fix for Red Hat Enterprise Linux 5.3, 5.6, 6.0, and 6.1.
May 11 2012 (Red Hat Issues Fix) PHP Command Parameter Bug Lets Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code   (bugzilla@redhat.com)
Red Hat has issued a fix for Red Hat Application Stack v2.



 Source Message Contents

Date:  Fri, 04 May 2012 15:14:32 +0000
Subject:  PHP


http://www.php.net/archive/2012.php#id2012-05-03-1

> There is a vulnerability in certain CGI-based setups (Apache+mod_php and 
> nginx+php-fpm are not affected) that has gone unnoticed for at least 8 years.

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

CVE-2012-1823
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC