Test ID:	1.3.6.1.4.1.25623.1.0.831627
Category:	Mandrake Local Security Checks
Title:	Mandriva Update for php MDVSA-2012:068-1 (php)
Summary:	The remote host is missing an update for the 'php'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'php' package(s) announced via the referenced advisory. Vulnerability Insight: A vulnerability has been found and corrected in php(-cgi): PHP-CGI-based setups contain a vulnerability when parsing query string parameters from php files. A remote unauthenticated attacker could obtain sensitive information, cause a denial of service condition or may be able to execute arbitrary code with the privileges of the web server (CVE-2012-1823). The updated packages have been patched to correct this issue. Update: It was discovered that the previous fix for the CVE-2012-1823 vulnerability was incomplete (CVE-2012-2335, CVE-2012-2336). The updated packages provides the latest version (5.3.13) which provides a solution to this flaw. Affected Software/OS: php on Mandriva Linux 2011.0, Mandriva Linux 2010.1 Solution: Please Install the Updated Packages. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-1823 http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html CERT/CC vulnerability note: VU#520827 http://www.kb.cert.org/vuls/id/520827 CERT/CC vulnerability note: VU#673343 http://www.kb.cert.org/vuls/id/673343 Debian Security Information: DSA-2465 (Google Search) http://www.debian.org/security/2012/dsa-2465 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ HPdes Security Advisory: HPSBMU02786 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 HPdes Security Advisory: HPSBUX02791 http://marc.info/?l=bugtraq&m=134012830914727&w=2 HPdes Security Advisory: SSRT100856 HPdes Security Advisory: SSRT100877 http://www.mandriva.com/security/advisories?name=MDVSA-2012:068 http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ http://www.openwall.com/lists/oss-security/2024/06/07/1 RedHat Security Advisories: RHSA-2012:0546 http://rhn.redhat.com/errata/RHSA-2012-0546.html RedHat Security Advisories: RHSA-2012:0547 http://rhn.redhat.com/errata/RHSA-2012-0547.html RedHat Security Advisories: RHSA-2012:0568 http://rhn.redhat.com/errata/RHSA-2012-0568.html RedHat Security Advisories: RHSA-2012:0569 http://rhn.redhat.com/errata/RHSA-2012-0569.html RedHat Security Advisories: RHSA-2012:0570 http://rhn.redhat.com/errata/RHSA-2012-0570.html http://www.securitytracker.com/id?1027022 http://secunia.com/advisories/49014 http://secunia.com/advisories/49065 http://secunia.com/advisories/49085 http://secunia.com/advisories/49087 SuSE Security Announcement: SUSE-SU-2012:0598 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html SuSE Security Announcement: SUSE-SU-2012:0604 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html SuSE Security Announcement: openSUSE-SU-2012:0590 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html Common Vulnerability Exposure (CVE) ID: CVE-2012-2335 49014 HPSBMU02900 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862 SSRT100992 SUSE-SU-2012:0721 http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00004.html SUSE-SU-2012:0840 http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html VU#520827 http://git.php.net/?p=php-src.git%3Ba=blob%3Bf=sapi/cgi/cgi_main.c%3Bh=a7ac26f0#l1569 http://www.php.net/archive/2012.php#id2012-05-06-1 https://bugs.php.net/bug.php?id=61910 php-phpwrapperfcgi-code-exec(75652) https://exchange.xforce.ibmcloud.com/vulnerabilities/75652 Common Vulnerability Exposure (CVE) ID: CVE-2012-2336 http://www.php.net/ChangeLog-5.php#5.4.3 http://www.php.net/archive/2012.php#id2012-05-08-1 https://bugs.php.net/patch-display.php?bug_id=61910&patch=CVE-2012-1823.patch&revision=1336251592&display=1
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.