PHP CVEs

Description

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

Affected products and versions

• PHP — Up to and including 5.3.12
• PHP versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.14, 5.2.15, 5.2.16, 5.2.17, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.3.7, 5.3.8, 5.3.9, 5.3.10, 5.3.11, 5.4.0, 5.4.0beta2, 5.4.1

References

• eindbazen.net http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
• lists.apple.com http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html
• marc.info http://marc.info/?l=bugtraq&m=134012830914727&w=2
• secunia.com http://secunia.com/advisories/49014
• secunia.com http://secunia.com/advisories/49085
• support.apple.com http://support.apple.com/kb/HT5501
• www.debian.org http://www.debian.org/security/2012/dsa-2465
• www.kb.cert.org http://www.kb.cert.org/vuls/id/520827 US Government Resource
• www.php.net http://www.php.net/ChangeLog-5.php#5.4.3
• www.php.net http://www.php.net/archive/2012.php#id2012-05-08-1
• www.securitytracker.com http://www.securitytracker.com/id?1027022
• bugs.php.net https://bugs.php.net/bug.php?id=61910 Vendor Advisory
• bugs.php.net https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff-fix-check.patch&revision=1336093719&display=1
• h20564.www2.hp.com https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862
• nvd.nist.gov Official NVD record