PHP < 4.3.8 Multiple Vulnerabilities

NASLDB: PHP < 4.3.8 Multiple Vulnerabilities

General

ID: 13650
Name: PHP < 4.3.8 Multiple Vulnerabilities

Summary: Checks for version of PHP

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Port: 80
Family: CGI abuses
Type: Remote

Description

The remote host is running a version of PHP 4.3 that is older or equal
to 4.3.7.

PHP is a scripting language that acts as a module for Apache or as a
standalone interpreter. There is a bug in the remote version of this
software that could allow an attacker to execute arbitrary code on the
remote host if the option memory_limit is set. Another bug in the
function strip_tags() may allow an attacker to bypass content
restrictions when submitting data and may lead to cross-site scripting
issues.