CIA RESEARCH
Alerts
[CIA-1036-Alert] PHP Multiple Vulnerabilities
Summary:
The PHP Hardening project discovered multiple security flaws in versions of PHP.
Technical Details:
Hardened PHP has discovered several vulnerabilities in PHP. These vulnerabilities affect PHP 4 versions 4.4.0 and prior, and PHP 5 versions 5.0.5 and prior.
PHP File-Upload Array Overwrite Vulnerability
PHP register_globals Activation Vulnerability in parse_str()
PHP Cross Site Scripting (XSS) Vulnerability in phpinfo())
These vulnerabilities can allow an attacker to obtain unauthorized access to a server running an affected version of PHP. Sites using affected versions should upgrade to a fixed version of PHP as soon as it becomes available.
Solution:
Upgrade to a fixed version of PHP 4.
PHP 4.4.1
A fix is still pending for PHP 5.
CVE Reference:
CAN-2005-2491
SecurityTracker Number(s):
1015129
1015130
1015131
Vendor URL:
Hardened PHP Advisories
http://www.hardened-php.net/advisory_202005.79.html
http://www.hardened-php.net/advisory_182005.77.html
http://www.hardened-php.net/advisory_192005.78.html
PHP.net
About the Cenzic CIA Team:
Cenzic Intelligent Analysis (CIA) is Cenzic?s research arm that
focuses on continuous research for application vulnerabilities.
Industry Research, Vulnerability assessment, penetration testing,
and security testing ? that?s what Cenzic Intelligent Analysis
Research is all about. Cenzic has dedicated experts whose sole
job is to perform ongoing research to find not only common
vulnerabilities but also vulnerabilities found in customer
applications and make them available to our customers and to
the community at large.
About Cenzic:
Cenzic provides Hailstorm? the revolutionary enterprise software
suite for automated application security assessment and compliance
that allows corporations and government organizations to
dramatically improve the security of commercial and custom applications.
Hailstorm enables security experts, QA professionals, and developers
to work together to assess, analyze, and remediate applications for
security vulnerabilities, and verify compliance with security
policies. Benefits include reduced security risk and liability,
lower development and testing costs, and faster time-to-market.
Cenzic?s customers are currently in the financial services and
e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC
|
