CIA RESEARCH

Alerts

[CIA-1067-Alert] PHP Multiple Vulnerabilities

Summary:

Several high risk security issues were recently disclosed in versions of PHP prior to 5.2.0

Technical Details:

Sites running a version of PHP prior to 5.2.0 should upgrade to the 5.2.0 release as soon as possible. Multiple Integer and Heap overflows that allow the execution of arbitrary code were disclosed in various PHP versions. Additional high risk vulnerabilities were disclosed in November. Among the vulnerabilities reported in October were buffer overflows in the processing of PHP's htmlentities() and htmlspecialchars() functions, which can facilitate buffer overflows in the processing of UTF-8 characters. Additional information on this vulnerability can be found in the Hardened-PHP Project advisory:
http://www.hardened-php.net/advisory_132006.138.html

The CVE reference section includes a number of PHP vulnerabilities that were fixed in the October release.

Solution:

Upgrade to the latest stable release of PHP, 5.2.0.

CVE Reference:

CVE-2006-4020

CVE-2006-4482

CVE-2006-4483

CVE-2006-4484

CVE-2006-4485

CVE-2006-4486

CVE-2006-4812

SecurityTracker Number(s):

1016984

Vendor URL:

PHP.net

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing - that's what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm® the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic's customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC