Test Kennung:	1.3.6.1.4.1.25623.1.0.802408
Kategorie:	Denial of Service
Titel:	PHP Web Form Hash Collision Denial of Service Vulnerability - Windows
Zusammenfassung:	PHP is prone to a remote denial of service vulnerability.
Beschreibung:	Summary: PHP is prone to a remote denial of service vulnerability. Vulnerability Insight: The flaws are due to an error in, - A hash generation function when hashing form posts and updating a hash table. This can be exploited to cause a hash collision resulting in high CPU consumption via a specially crafted form sent in a HTTP POST request. - PDORow implementation, when interacting with the session feature. - timezone functionality, when handling php_date_parse_tzfile cache. Vulnerability Impact: Successful exploitation could allow remote attackers to cause a denial of service via a specially crafted form sent in a HTTP POST request. Affected Software/OS: PHP Version 5.3.8 and prior. Solution: Update PHP to 5.3.9 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4885 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html BugTraq ID: 51193 http://www.securityfocus.com/bid/51193 Bugtraq: 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table (Google Search) http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html CERT/CC vulnerability note: VU#903934 http://www.kb.cert.org/vuls/id/903934 Debian Security Information: DSA-2399 (Google Search) http://www.debian.org/security/2012/dsa-2399 http://www.exploit-db.com/exploits/18296 http://www.exploit-db.com/exploits/18305 HPdes Security Advisory: HPSBMU02786 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 HPdes Security Advisory: HPSBOV02763 http://marc.info/?l=bugtraq&m=133469208622507&w=2 HPdes Security Advisory: HPSBUX02741 http://marc.info/?l=bugtraq&m=132871655717248&w=2 HPdes Security Advisory: SSRT100728 HPdes Security Advisory: SSRT100826 HPdes Security Advisory: SSRT100877 http://www.mandriva.com/security/advisories?name=MDVSA-2011:197 http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.nruns.com/_downloads/advisory28122011.pdf http://www.ocert.org/advisories/ocert-2011-003.html https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py http://www.redhat.com/support/errata/RHSA-2012-0019.html RedHat Security Advisories: RHSA-2012:0071 http://rhn.redhat.com/errata/RHSA-2012-0071.html http://www.securitytracker.com/id?1026473 http://secunia.com/advisories/47404 http://secunia.com/advisories/48668 SuSE Security Announcement: SUSE-SU-2012:0411 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html SuSE Security Announcement: openSUSE-SU-2012:0426 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html XForce ISS Database: php-hash-dos(72021) https://exchange.xforce.ibmcloud.com/vulnerabilities/72021 Common Vulnerability Exposure (CVE) ID: CVE-2012-0788 Common Vulnerability Exposure (CVE) ID: CVE-2012-0789
Copyright	Copyright (C) 2012 Greenbone AG

Dies ist nur einer von 146377 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.