Amazon Linux AMI update for php

Published: 2014-08-21

Risk	High
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2013-6712 CVE-2014-0207 CVE-2014-0237 CVE-2014-0238 CVE-2014-3515 CVE-2014-3981 CVE-2014-4049
CWE-ID	CWE-126 CWE-617 CWE-264 CWE-835 CWE-843 CWE-59 CWE-122
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #5 is available.
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Buffer over-read

EUVDB-ID: #VU16077

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2013-6712

CWE-ID: CWE-126 - Buffer over-read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to the scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects. A remote attacker can trigger heap-based buffer over-read and cause the service to crash via a crafted interval specification.

Mitigation

Update the affected packages:

i686:
    php-enchant-5.3.29-1.7.amzn1.i686
    php-5.3.29-1.7.amzn1.i686
    php-devel-5.3.29-1.7.amzn1.i686
    php-xmlrpc-5.3.29-1.7.amzn1.i686
    php-bcmath-5.3.29-1.7.amzn1.i686
    php-fpm-5.3.29-1.7.amzn1.i686
    php-tidy-5.3.29-1.7.amzn1.i686
    php-embedded-5.3.29-1.7.amzn1.i686
    php-mysql-5.3.29-1.7.amzn1.i686
    php-xml-5.3.29-1.7.amzn1.i686
    php-mcrypt-5.3.29-1.7.amzn1.i686
    php-snmp-5.3.29-1.7.amzn1.i686
    php-pspell-5.3.29-1.7.amzn1.i686
    php-mssql-5.3.29-1.7.amzn1.i686
    php-ldap-5.3.29-1.7.amzn1.i686
    php-intl-5.3.29-1.7.amzn1.i686
    php-odbc-5.3.29-1.7.amzn1.i686
    php-debuginfo-5.3.29-1.7.amzn1.i686
    php-pdo-5.3.29-1.7.amzn1.i686
    php-mbstring-5.3.29-1.7.amzn1.i686
    php-gd-5.3.29-1.7.amzn1.i686
    php-recode-5.3.29-1.7.amzn1.i686
    php-pgsql-5.3.29-1.7.amzn1.i686
    php-imap-5.3.29-1.7.amzn1.i686
    php-cli-5.3.29-1.7.amzn1.i686
    php-soap-5.3.29-1.7.amzn1.i686
    php-process-5.3.29-1.7.amzn1.i686
    php-dba-5.3.29-1.7.amzn1.i686
    php-common-5.3.29-1.7.amzn1.i686
    php-mysqlnd-5.3.29-1.7.amzn1.i686

src:
    php-5.3.29-1.7.amzn1.src

x86_64:
    php-debuginfo-5.3.29-1.7.amzn1.x86_64
    php-tidy-5.3.29-1.7.amzn1.x86_64
    php-enchant-5.3.29-1.7.amzn1.x86_64
    php-5.3.29-1.7.amzn1.x86_64
    php-pdo-5.3.29-1.7.amzn1.x86_64
    php-mcrypt-5.3.29-1.7.amzn1.x86_64
    php-mssql-5.3.29-1.7.amzn1.x86_64
    php-cli-5.3.29-1.7.amzn1.x86_64
    php-recode-5.3.29-1.7.amzn1.x86_64
    php-ldap-5.3.29-1.7.amzn1.x86_64
    php-dba-5.3.29-1.7.amzn1.x86_64
    php-xml-5.3.29-1.7.amzn1.x86_64
    php-intl-5.3.29-1.7.amzn1.x86_64
    php-snmp-5.3.29-1.7.amzn1.x86_64
    php-embedded-5.3.29-1.7.amzn1.x86_64
    php-xmlrpc-5.3.29-1.7.amzn1.x86_64
    php-imap-5.3.29-1.7.amzn1.x86_64
    php-devel-5.3.29-1.7.amzn1.x86_64
    php-bcmath-5.3.29-1.7.amzn1.x86_64
    php-odbc-5.3.29-1.7.amzn1.x86_64
    php-soap-5.3.29-1.7.amzn1.x86_64
    php-mysql-5.3.29-1.7.amzn1.x86_64
    php-mysqlnd-5.3.29-1.7.amzn1.x86_64
    php-mbstring-5.3.29-1.7.amzn1.x86_64
    php-pgsql-5.3.29-1.7.amzn1.x86_64
    php-gd-5.3.29-1.7.amzn1.x86_64
    php-process-5.3.29-1.7.amzn1.x86_64
    php-fpm-5.3.29-1.7.amzn1.x86_64
    php-common-5.3.29-1.7.amzn1.x86_64
    php-pspell-5.3.29-1.7.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2014-393.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Reachable assertion

EUVDB-ID: #VU16087

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-0207

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to assertion failure in the cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14. A remote attacker can trigger reachable assertion via a specially crafted CDF file and cause the service to crash.

Mitigation

Update the affected packages:

i686:
    php-enchant-5.3.29-1.7.amzn1.i686
    php-5.3.29-1.7.amzn1.i686
    php-devel-5.3.29-1.7.amzn1.i686
    php-xmlrpc-5.3.29-1.7.amzn1.i686
    php-bcmath-5.3.29-1.7.amzn1.i686
    php-fpm-5.3.29-1.7.amzn1.i686
    php-tidy-5.3.29-1.7.amzn1.i686
    php-embedded-5.3.29-1.7.amzn1.i686
    php-mysql-5.3.29-1.7.amzn1.i686
    php-xml-5.3.29-1.7.amzn1.i686
    php-mcrypt-5.3.29-1.7.amzn1.i686
    php-snmp-5.3.29-1.7.amzn1.i686
    php-pspell-5.3.29-1.7.amzn1.i686
    php-mssql-5.3.29-1.7.amzn1.i686
    php-ldap-5.3.29-1.7.amzn1.i686
    php-intl-5.3.29-1.7.amzn1.i686
    php-odbc-5.3.29-1.7.amzn1.i686
    php-debuginfo-5.3.29-1.7.amzn1.i686
    php-pdo-5.3.29-1.7.amzn1.i686
    php-mbstring-5.3.29-1.7.amzn1.i686
    php-gd-5.3.29-1.7.amzn1.i686
    php-recode-5.3.29-1.7.amzn1.i686
    php-pgsql-5.3.29-1.7.amzn1.i686
    php-imap-5.3.29-1.7.amzn1.i686
    php-cli-5.3.29-1.7.amzn1.i686
    php-soap-5.3.29-1.7.amzn1.i686
    php-process-5.3.29-1.7.amzn1.i686
    php-dba-5.3.29-1.7.amzn1.i686
    php-common-5.3.29-1.7.amzn1.i686
    php-mysqlnd-5.3.29-1.7.amzn1.i686

src:
    php-5.3.29-1.7.amzn1.src

x86_64:
    php-debuginfo-5.3.29-1.7.amzn1.x86_64
    php-tidy-5.3.29-1.7.amzn1.x86_64
    php-enchant-5.3.29-1.7.amzn1.x86_64
    php-5.3.29-1.7.amzn1.x86_64
    php-pdo-5.3.29-1.7.amzn1.x86_64
    php-mcrypt-5.3.29-1.7.amzn1.x86_64
    php-mssql-5.3.29-1.7.amzn1.x86_64
    php-cli-5.3.29-1.7.amzn1.x86_64
    php-recode-5.3.29-1.7.amzn1.x86_64
    php-ldap-5.3.29-1.7.amzn1.x86_64
    php-dba-5.3.29-1.7.amzn1.x86_64
    php-xml-5.3.29-1.7.amzn1.x86_64
    php-intl-5.3.29-1.7.amzn1.x86_64
    php-snmp-5.3.29-1.7.amzn1.x86_64
    php-embedded-5.3.29-1.7.amzn1.x86_64
    php-xmlrpc-5.3.29-1.7.amzn1.x86_64
    php-imap-5.3.29-1.7.amzn1.x86_64
    php-devel-5.3.29-1.7.amzn1.x86_64
    php-bcmath-5.3.29-1.7.amzn1.x86_64
    php-odbc-5.3.29-1.7.amzn1.x86_64
    php-soap-5.3.29-1.7.amzn1.x86_64
    php-mysql-5.3.29-1.7.amzn1.x86_64
    php-mysqlnd-5.3.29-1.7.amzn1.x86_64
    php-mbstring-5.3.29-1.7.amzn1.x86_64
    php-pgsql-5.3.29-1.7.amzn1.x86_64
    php-gd-5.3.29-1.7.amzn1.x86_64
    php-process-5.3.29-1.7.amzn1.x86_64
    php-fpm-5.3.29-1.7.amzn1.x86_64
    php-common-5.3.29-1.7.amzn1.x86_64
    php-pspell-5.3.29-1.7.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2014-393.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Denial of service

EUVDB-ID: #VU16084

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-0237

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 due to performance degradation. A remote attacker can trigger many file_printf calls and cause the service to crash.

Mitigation

Update the affected packages:

i686:
    php-enchant-5.3.29-1.7.amzn1.i686
    php-5.3.29-1.7.amzn1.i686
    php-devel-5.3.29-1.7.amzn1.i686
    php-xmlrpc-5.3.29-1.7.amzn1.i686
    php-bcmath-5.3.29-1.7.amzn1.i686
    php-fpm-5.3.29-1.7.amzn1.i686
    php-tidy-5.3.29-1.7.amzn1.i686
    php-embedded-5.3.29-1.7.amzn1.i686
    php-mysql-5.3.29-1.7.amzn1.i686
    php-xml-5.3.29-1.7.amzn1.i686
    php-mcrypt-5.3.29-1.7.amzn1.i686
    php-snmp-5.3.29-1.7.amzn1.i686
    php-pspell-5.3.29-1.7.amzn1.i686
    php-mssql-5.3.29-1.7.amzn1.i686
    php-ldap-5.3.29-1.7.amzn1.i686
    php-intl-5.3.29-1.7.amzn1.i686
    php-odbc-5.3.29-1.7.amzn1.i686
    php-debuginfo-5.3.29-1.7.amzn1.i686
    php-pdo-5.3.29-1.7.amzn1.i686
    php-mbstring-5.3.29-1.7.amzn1.i686
    php-gd-5.3.29-1.7.amzn1.i686
    php-recode-5.3.29-1.7.amzn1.i686
    php-pgsql-5.3.29-1.7.amzn1.i686
    php-imap-5.3.29-1.7.amzn1.i686
    php-cli-5.3.29-1.7.amzn1.i686
    php-soap-5.3.29-1.7.amzn1.i686
    php-process-5.3.29-1.7.amzn1.i686
    php-dba-5.3.29-1.7.amzn1.i686
    php-common-5.3.29-1.7.amzn1.i686
    php-mysqlnd-5.3.29-1.7.amzn1.i686

src:
    php-5.3.29-1.7.amzn1.src

x86_64:
    php-debuginfo-5.3.29-1.7.amzn1.x86_64
    php-tidy-5.3.29-1.7.amzn1.x86_64
    php-enchant-5.3.29-1.7.amzn1.x86_64
    php-5.3.29-1.7.amzn1.x86_64
    php-pdo-5.3.29-1.7.amzn1.x86_64
    php-mcrypt-5.3.29-1.7.amzn1.x86_64
    php-mssql-5.3.29-1.7.amzn1.x86_64
    php-cli-5.3.29-1.7.amzn1.x86_64
    php-recode-5.3.29-1.7.amzn1.x86_64
    php-ldap-5.3.29-1.7.amzn1.x86_64
    php-dba-5.3.29-1.7.amzn1.x86_64
    php-xml-5.3.29-1.7.amzn1.x86_64
    php-intl-5.3.29-1.7.amzn1.x86_64
    php-snmp-5.3.29-1.7.amzn1.x86_64
    php-embedded-5.3.29-1.7.amzn1.x86_64
    php-xmlrpc-5.3.29-1.7.amzn1.x86_64
    php-imap-5.3.29-1.7.amzn1.x86_64
    php-devel-5.3.29-1.7.amzn1.x86_64
    php-bcmath-5.3.29-1.7.amzn1.x86_64
    php-odbc-5.3.29-1.7.amzn1.x86_64
    php-soap-5.3.29-1.7.amzn1.x86_64
    php-mysql-5.3.29-1.7.amzn1.x86_64
    php-mysqlnd-5.3.29-1.7.amzn1.x86_64
    php-mbstring-5.3.29-1.7.amzn1.x86_64
    php-pgsql-5.3.29-1.7.amzn1.x86_64
    php-gd-5.3.29-1.7.amzn1.x86_64
    php-process-5.3.29-1.7.amzn1.x86_64
    php-fpm-5.3.29-1.7.amzn1.x86_64
    php-common-5.3.29-1.7.amzn1.x86_64
    php-pspell-5.3.29-1.7.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2014-393.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Infinite loop

EUVDB-ID: #VU16085

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-0238

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13. A remote attacker can trigger out-of-bounds memory access via a vector that (1) has zero length or (2) is too long and cause the service to crash.

Mitigation

Update the affected packages:

i686:
    php-enchant-5.3.29-1.7.amzn1.i686
    php-5.3.29-1.7.amzn1.i686
    php-devel-5.3.29-1.7.amzn1.i686
    php-xmlrpc-5.3.29-1.7.amzn1.i686
    php-bcmath-5.3.29-1.7.amzn1.i686
    php-fpm-5.3.29-1.7.amzn1.i686
    php-tidy-5.3.29-1.7.amzn1.i686
    php-embedded-5.3.29-1.7.amzn1.i686
    php-mysql-5.3.29-1.7.amzn1.i686
    php-xml-5.3.29-1.7.amzn1.i686
    php-mcrypt-5.3.29-1.7.amzn1.i686
    php-snmp-5.3.29-1.7.amzn1.i686
    php-pspell-5.3.29-1.7.amzn1.i686
    php-mssql-5.3.29-1.7.amzn1.i686
    php-ldap-5.3.29-1.7.amzn1.i686
    php-intl-5.3.29-1.7.amzn1.i686
    php-odbc-5.3.29-1.7.amzn1.i686
    php-debuginfo-5.3.29-1.7.amzn1.i686
    php-pdo-5.3.29-1.7.amzn1.i686
    php-mbstring-5.3.29-1.7.amzn1.i686
    php-gd-5.3.29-1.7.amzn1.i686
    php-recode-5.3.29-1.7.amzn1.i686
    php-pgsql-5.3.29-1.7.amzn1.i686
    php-imap-5.3.29-1.7.amzn1.i686
    php-cli-5.3.29-1.7.amzn1.i686
    php-soap-5.3.29-1.7.amzn1.i686
    php-process-5.3.29-1.7.amzn1.i686
    php-dba-5.3.29-1.7.amzn1.i686
    php-common-5.3.29-1.7.amzn1.i686
    php-mysqlnd-5.3.29-1.7.amzn1.i686

src:
    php-5.3.29-1.7.amzn1.src

x86_64:
    php-debuginfo-5.3.29-1.7.amzn1.x86_64
    php-tidy-5.3.29-1.7.amzn1.x86_64
    php-enchant-5.3.29-1.7.amzn1.x86_64
    php-5.3.29-1.7.amzn1.x86_64
    php-pdo-5.3.29-1.7.amzn1.x86_64
    php-mcrypt-5.3.29-1.7.amzn1.x86_64
    php-mssql-5.3.29-1.7.amzn1.x86_64
    php-cli-5.3.29-1.7.amzn1.x86_64
    php-recode-5.3.29-1.7.amzn1.x86_64
    php-ldap-5.3.29-1.7.amzn1.x86_64
    php-dba-5.3.29-1.7.amzn1.x86_64
    php-xml-5.3.29-1.7.amzn1.x86_64
    php-intl-5.3.29-1.7.amzn1.x86_64
    php-snmp-5.3.29-1.7.amzn1.x86_64
    php-embedded-5.3.29-1.7.amzn1.x86_64
    php-xmlrpc-5.3.29-1.7.amzn1.x86_64
    php-imap-5.3.29-1.7.amzn1.x86_64
    php-devel-5.3.29-1.7.amzn1.x86_64
    php-bcmath-5.3.29-1.7.amzn1.x86_64
    php-odbc-5.3.29-1.7.amzn1.x86_64
    php-soap-5.3.29-1.7.amzn1.x86_64
    php-mysql-5.3.29-1.7.amzn1.x86_64
    php-mysqlnd-5.3.29-1.7.amzn1.x86_64
    php-mbstring-5.3.29-1.7.amzn1.x86_64
    php-pgsql-5.3.29-1.7.amzn1.x86_64
    php-gd-5.3.29-1.7.amzn1.x86_64
    php-process-5.3.29-1.7.amzn1.x86_64
    php-fpm-5.3.29-1.7.amzn1.x86_64
    php-common-5.3.29-1.7.amzn1.x86_64
    php-pspell-5.3.29-1.7.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2014-393.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Type Confusion

EUVDB-ID: #VU16092

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2014-3515

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in (1) ArrayObject and (2) SPLObjectStorage. when the SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization. A remote attacker can trigger a type confusion error via a crafted string that triggers use of a Hashtable destructor and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    php-enchant-5.3.29-1.7.amzn1.i686
    php-5.3.29-1.7.amzn1.i686
    php-devel-5.3.29-1.7.amzn1.i686
    php-xmlrpc-5.3.29-1.7.amzn1.i686
    php-bcmath-5.3.29-1.7.amzn1.i686
    php-fpm-5.3.29-1.7.amzn1.i686
    php-tidy-5.3.29-1.7.amzn1.i686
    php-embedded-5.3.29-1.7.amzn1.i686
    php-mysql-5.3.29-1.7.amzn1.i686
    php-xml-5.3.29-1.7.amzn1.i686
    php-mcrypt-5.3.29-1.7.amzn1.i686
    php-snmp-5.3.29-1.7.amzn1.i686
    php-pspell-5.3.29-1.7.amzn1.i686
    php-mssql-5.3.29-1.7.amzn1.i686
    php-ldap-5.3.29-1.7.amzn1.i686
    php-intl-5.3.29-1.7.amzn1.i686
    php-odbc-5.3.29-1.7.amzn1.i686
    php-debuginfo-5.3.29-1.7.amzn1.i686
    php-pdo-5.3.29-1.7.amzn1.i686
    php-mbstring-5.3.29-1.7.amzn1.i686
    php-gd-5.3.29-1.7.amzn1.i686
    php-recode-5.3.29-1.7.amzn1.i686
    php-pgsql-5.3.29-1.7.amzn1.i686
    php-imap-5.3.29-1.7.amzn1.i686
    php-cli-5.3.29-1.7.amzn1.i686
    php-soap-5.3.29-1.7.amzn1.i686
    php-process-5.3.29-1.7.amzn1.i686
    php-dba-5.3.29-1.7.amzn1.i686
    php-common-5.3.29-1.7.amzn1.i686
    php-mysqlnd-5.3.29-1.7.amzn1.i686

src:
    php-5.3.29-1.7.amzn1.src

x86_64:
    php-debuginfo-5.3.29-1.7.amzn1.x86_64
    php-tidy-5.3.29-1.7.amzn1.x86_64
    php-enchant-5.3.29-1.7.amzn1.x86_64
    php-5.3.29-1.7.amzn1.x86_64
    php-pdo-5.3.29-1.7.amzn1.x86_64
    php-mcrypt-5.3.29-1.7.amzn1.x86_64
    php-mssql-5.3.29-1.7.amzn1.x86_64
    php-cli-5.3.29-1.7.amzn1.x86_64
    php-recode-5.3.29-1.7.amzn1.x86_64
    php-ldap-5.3.29-1.7.amzn1.x86_64
    php-dba-5.3.29-1.7.amzn1.x86_64
    php-xml-5.3.29-1.7.amzn1.x86_64
    php-intl-5.3.29-1.7.amzn1.x86_64
    php-snmp-5.3.29-1.7.amzn1.x86_64
    php-embedded-5.3.29-1.7.amzn1.x86_64
    php-xmlrpc-5.3.29-1.7.amzn1.x86_64
    php-imap-5.3.29-1.7.amzn1.x86_64
    php-devel-5.3.29-1.7.amzn1.x86_64
    php-bcmath-5.3.29-1.7.amzn1.x86_64
    php-odbc-5.3.29-1.7.amzn1.x86_64
    php-soap-5.3.29-1.7.amzn1.x86_64
    php-mysql-5.3.29-1.7.amzn1.x86_64
    php-mysqlnd-5.3.29-1.7.amzn1.x86_64
    php-mbstring-5.3.29-1.7.amzn1.x86_64
    php-pgsql-5.3.29-1.7.amzn1.x86_64
    php-gd-5.3.29-1.7.amzn1.x86_64
    php-process-5.3.29-1.7.amzn1.x86_64
    php-fpm-5.3.29-1.7.amzn1.x86_64
    php-common-5.3.29-1.7.amzn1.x86_64
    php-pspell-5.3.29-1.7.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2014-393.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) Link following

EUVDB-ID: #VU41567

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-3981

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

Mitigation

Update the affected packages:

i686:
    php-enchant-5.3.29-1.7.amzn1.i686
    php-5.3.29-1.7.amzn1.i686
    php-devel-5.3.29-1.7.amzn1.i686
    php-xmlrpc-5.3.29-1.7.amzn1.i686
    php-bcmath-5.3.29-1.7.amzn1.i686
    php-fpm-5.3.29-1.7.amzn1.i686
    php-tidy-5.3.29-1.7.amzn1.i686
    php-embedded-5.3.29-1.7.amzn1.i686
    php-mysql-5.3.29-1.7.amzn1.i686
    php-xml-5.3.29-1.7.amzn1.i686
    php-mcrypt-5.3.29-1.7.amzn1.i686
    php-snmp-5.3.29-1.7.amzn1.i686
    php-pspell-5.3.29-1.7.amzn1.i686
    php-mssql-5.3.29-1.7.amzn1.i686
    php-ldap-5.3.29-1.7.amzn1.i686
    php-intl-5.3.29-1.7.amzn1.i686
    php-odbc-5.3.29-1.7.amzn1.i686
    php-debuginfo-5.3.29-1.7.amzn1.i686
    php-pdo-5.3.29-1.7.amzn1.i686
    php-mbstring-5.3.29-1.7.amzn1.i686
    php-gd-5.3.29-1.7.amzn1.i686
    php-recode-5.3.29-1.7.amzn1.i686
    php-pgsql-5.3.29-1.7.amzn1.i686
    php-imap-5.3.29-1.7.amzn1.i686
    php-cli-5.3.29-1.7.amzn1.i686
    php-soap-5.3.29-1.7.amzn1.i686
    php-process-5.3.29-1.7.amzn1.i686
    php-dba-5.3.29-1.7.amzn1.i686
    php-common-5.3.29-1.7.amzn1.i686
    php-mysqlnd-5.3.29-1.7.amzn1.i686

src:
    php-5.3.29-1.7.amzn1.src

x86_64:
    php-debuginfo-5.3.29-1.7.amzn1.x86_64
    php-tidy-5.3.29-1.7.amzn1.x86_64
    php-enchant-5.3.29-1.7.amzn1.x86_64
    php-5.3.29-1.7.amzn1.x86_64
    php-pdo-5.3.29-1.7.amzn1.x86_64
    php-mcrypt-5.3.29-1.7.amzn1.x86_64
    php-mssql-5.3.29-1.7.amzn1.x86_64
    php-cli-5.3.29-1.7.amzn1.x86_64
    php-recode-5.3.29-1.7.amzn1.x86_64
    php-ldap-5.3.29-1.7.amzn1.x86_64
    php-dba-5.3.29-1.7.amzn1.x86_64
    php-xml-5.3.29-1.7.amzn1.x86_64
    php-intl-5.3.29-1.7.amzn1.x86_64
    php-snmp-5.3.29-1.7.amzn1.x86_64
    php-embedded-5.3.29-1.7.amzn1.x86_64
    php-xmlrpc-5.3.29-1.7.amzn1.x86_64
    php-imap-5.3.29-1.7.amzn1.x86_64
    php-devel-5.3.29-1.7.amzn1.x86_64
    php-bcmath-5.3.29-1.7.amzn1.x86_64
    php-odbc-5.3.29-1.7.amzn1.x86_64
    php-soap-5.3.29-1.7.amzn1.x86_64
    php-mysql-5.3.29-1.7.amzn1.x86_64
    php-mysqlnd-5.3.29-1.7.amzn1.x86_64
    php-mbstring-5.3.29-1.7.amzn1.x86_64
    php-pgsql-5.3.29-1.7.amzn1.x86_64
    php-gd-5.3.29-1.7.amzn1.x86_64
    php-process-5.3.29-1.7.amzn1.x86_64
    php-fpm-5.3.29-1.7.amzn1.x86_64
    php-common-5.3.29-1.7.amzn1.x86_64
    php-pspell-5.3.29-1.7.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2014-393.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Heap-based buffer overflow

EUVDB-ID: #VU16086

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2014-4049

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow in the php_parserr function in ext/standard/dns.c. A remote attacker can trigger memory corruption via a crafted DNS TXT record, related to the dns_get_record function and cause the service to crash or execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    php-enchant-5.3.29-1.7.amzn1.i686
    php-5.3.29-1.7.amzn1.i686
    php-devel-5.3.29-1.7.amzn1.i686
    php-xmlrpc-5.3.29-1.7.amzn1.i686
    php-bcmath-5.3.29-1.7.amzn1.i686
    php-fpm-5.3.29-1.7.amzn1.i686
    php-tidy-5.3.29-1.7.amzn1.i686
    php-embedded-5.3.29-1.7.amzn1.i686
    php-mysql-5.3.29-1.7.amzn1.i686
    php-xml-5.3.29-1.7.amzn1.i686
    php-mcrypt-5.3.29-1.7.amzn1.i686
    php-snmp-5.3.29-1.7.amzn1.i686
    php-pspell-5.3.29-1.7.amzn1.i686
    php-mssql-5.3.29-1.7.amzn1.i686
    php-ldap-5.3.29-1.7.amzn1.i686
    php-intl-5.3.29-1.7.amzn1.i686
    php-odbc-5.3.29-1.7.amzn1.i686
    php-debuginfo-5.3.29-1.7.amzn1.i686
    php-pdo-5.3.29-1.7.amzn1.i686
    php-mbstring-5.3.29-1.7.amzn1.i686
    php-gd-5.3.29-1.7.amzn1.i686
    php-recode-5.3.29-1.7.amzn1.i686
    php-pgsql-5.3.29-1.7.amzn1.i686
    php-imap-5.3.29-1.7.amzn1.i686
    php-cli-5.3.29-1.7.amzn1.i686
    php-soap-5.3.29-1.7.amzn1.i686
    php-process-5.3.29-1.7.amzn1.i686
    php-dba-5.3.29-1.7.amzn1.i686
    php-common-5.3.29-1.7.amzn1.i686
    php-mysqlnd-5.3.29-1.7.amzn1.i686

src:
    php-5.3.29-1.7.amzn1.src

x86_64:
    php-debuginfo-5.3.29-1.7.amzn1.x86_64
    php-tidy-5.3.29-1.7.amzn1.x86_64
    php-enchant-5.3.29-1.7.amzn1.x86_64
    php-5.3.29-1.7.amzn1.x86_64
    php-pdo-5.3.29-1.7.amzn1.x86_64
    php-mcrypt-5.3.29-1.7.amzn1.x86_64
    php-mssql-5.3.29-1.7.amzn1.x86_64
    php-cli-5.3.29-1.7.amzn1.x86_64
    php-recode-5.3.29-1.7.amzn1.x86_64
    php-ldap-5.3.29-1.7.amzn1.x86_64
    php-dba-5.3.29-1.7.amzn1.x86_64
    php-xml-5.3.29-1.7.amzn1.x86_64
    php-intl-5.3.29-1.7.amzn1.x86_64
    php-snmp-5.3.29-1.7.amzn1.x86_64
    php-embedded-5.3.29-1.7.amzn1.x86_64
    php-xmlrpc-5.3.29-1.7.amzn1.x86_64
    php-imap-5.3.29-1.7.amzn1.x86_64
    php-devel-5.3.29-1.7.amzn1.x86_64
    php-bcmath-5.3.29-1.7.amzn1.x86_64
    php-odbc-5.3.29-1.7.amzn1.x86_64
    php-soap-5.3.29-1.7.amzn1.x86_64
    php-mysql-5.3.29-1.7.amzn1.x86_64
    php-mysqlnd-5.3.29-1.7.amzn1.x86_64
    php-mbstring-5.3.29-1.7.amzn1.x86_64
    php-pgsql-5.3.29-1.7.amzn1.x86_64
    php-gd-5.3.29-1.7.amzn1.x86_64
    php-process-5.3.29-1.7.amzn1.x86_64
    php-fpm-5.3.29-1.7.amzn1.x86_64
    php-common-5.3.29-1.7.amzn1.x86_64
    php-pspell-5.3.29-1.7.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2014-393.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.