Security Bulletin: Multiple vulnerabilities in php affect IBM Flex System Manger (FSM)

Vulnerability Details

Summary

There are multiple vulnerabilities in php that is included in IBM Flex System Manager (FSM). This bulletin addresses these vulnerabilities.

Vulnerability Details

CVE-ID: CVE-2014-9709

Description: gd-libgd is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by gd_gif_in.c. By sending a specially-crafted GIF file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.

CVSS Base Score: 6.8
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/101757 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2015-0232

Description: PHP could allow a remote attacker to execute arbitrary code on the system, caused by an error in the exif_process_unicode function. An attacker could exploit this vulnerability using specially-crafted EXIF data to execute arbitrary code on the system.

CVSS Base Score: 7.5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/100570 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2015-2305

Description: Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.

CVSS Base Score: 6.8
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/100899 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2015-2787

Description: PHP could allow a remote attacker to execute arbitrary code on the system, caused by an use-after-free error in the unserialize() function. By abusing the defined __wakeup() magic method, an attacker could exploit this vulnerability to execute arbitrary PHP code on the system.

CVSS Base Score: 6.8
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/101822 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2015-3411

Description: PHP could allow a remote attacker to bypass security restrictions, caused by the failure to properly handle file names containing a NULL character. An attacker could exploit this vulnerability using a path name containing null characters to bypass file system access restrictions.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104108 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVE-ID: CVE-2015-3412

Description: PHP could allow a remote attacker to bypass security restrictions, caused by the failure to properly handle file names containing a NULL character. An attacker could exploit this vulnerability using a path name containing null characters to bypass file system access restrictions.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104109 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVE-ID: CVE-2015-4022

Description: PHP is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the FTP extension in the parsing of file listings. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

CVSS Base Score: 7.5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/103518 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2015-4024

Description: PHP is vulnerable to a denial of service, caused by an error when parsing malicious requests. By sending a specially-crafted HTTP POST request, an attacker could exploit this vulnerability to consume all available CPU resources.

CVSS Base Score: 5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/103516 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-ID: CVE-2015-4026

Description: PHP could allow a remote attacker to bypass security restrictions, caused by the acceptance of a NULL value in a path by the pcnt_exec() function. By sending a specially-crafted value, an attacker could exploit this vulnerability to bypass security controls.

CVSS Base Score: 5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/103515 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVE-ID: CVE-2015-4147

Description: PHP could allow a remote attacker to execute arbitrary code on the system, caused by a type confusion error in the SoapClient __call() function. By sending specially crafted data when processed by the unserialize() function, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVSS Base Score: 7.5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/103612 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2015-4148

Description: PHP could allow a remote attacker to execute arbitrary code on the system, caused by a type confusion error in the SoapClient do_soap_call() function. By sending specially crafted data when processed by the unserialize() function, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVSS Base Score: 7.5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/103613 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2015-4598

Description: PHP could allow a remote attacker to bypass security restrictions, caused by the failure to properly handle file names containing a NULL character. An attacker could exploit this vulnerability using a path name containing null characters to bypass file system access restrictions.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104110 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVE-ID: CVE-2015-4599

Description: PHP could allow a remote attacker to obtain sensitive information, caused by a type confusion error in the SOAP extension. By sending specially crafted data processed by the unserialize() function, an attacker could exploit this vulnerability to obtain memory or cause the application to crash.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104111 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2015-4600

Description: PHP could allow a remote attacker to obtain sensitive information, caused by a type confusion error in the SOAP extension. By sending specially crafted data processed by the unserialize() function, an attacker could exploit this vulnerability to obtain memory or cause the application to crash.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104112 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2015-4601

Description: PHP could allow a remote attacker to obtain sensitive information, caused by a type confusion error in the SOAP extension. By sending specially crafted data processed by the unserialize() function, an attacker could exploit this vulnerability to obtain memory or cause the application to crash.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104113 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2015-4602

Description: PHP could allow a remote attacker to obtain sensitive information, caused by a type confusion error in the exception::getTraceAsStrin() function. By sending specially crafted data, an attacker could exploit this vulnerability to obtain memory or cause the application to crash.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104114 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2015-4603

Description: PHP could allow a remote attacker to obtain sensitive information, caused by a type confusion error in the exception::getTraceAsStrin() function. By sending specially crafted data, an attacker could exploit this vulnerability to obtain memory or cause the application to crash.

CVSS Base Score: 4.3
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104115 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVE-ID: CVE-2015-4604

Description: PHP is vulnerable to a denial of service, caused by a memory allocation error in the finfo::file() or finfo::buffer() functions. By sending specially crafted data, a remote attacker could exploit this vulnerability to cause the application to crash.

CVSS Base Score: 5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104116 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-ID: CVE-2015-4605

Description: PHP is vulnerable to a denial of service, caused by a memory allocation error in the finfo::file() or finfo::buffer() functions. By sending specially crafted data, a remote attacker could exploit this vulnerability to cause the application to crash.

CVSS Base Score: 5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/104117 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVE-ID: CVE-2015-4643

Description: PHP is vulnerable to a heap-based buffer overflow, caused by an integer overflow in the ftp_genlist() function. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

CVSS Base Score: 7.5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/103926 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVE-ID: CVE-2015-4644

Description: PHP is vulnerable to a denial of service, caused by an error in php_pgsql_meta_data. A remote attacker could exploit this vulnerability to cause a segfault.

CVSS Base Score: 5
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/103927 for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

• Flex System Manager 1.1.x.x
• Flex System Manager 1.2.0.x
• Flex System Manager 1.2.1.x
• Flex System Manager 1.3.0.x
• Flex System Manager 1.3.1.x
• Flex System Manager 1.3.2.x
• Flex System Manager 1.3.3.x
• Flex System Manager 1.3.4.x

Remediation/Fixes

Workarounds and Mitigation

None.

Reference

• Complete CVSS V2 Guide
• On-line Calculator V2

Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

Acknowledgement

None.

Change History
11 September 2015: Original Copy Published
12 October 2015: Added 1.3.4

* The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.