CVE-2015-4147
published 2015-06-09CVE-2015-4147: The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an…
PriorityP355high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
12.27%
95.7th percentile
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.10.4 | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| php | php | <= 5.4.38 | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is triggered via crafted serialized data passed to PHP's unserialize() function, where __default_headers in SoapClient is not verified to be an array — monitor for unexpected data types in deserialized SoapClient objects ↗
- →The attack vector is through PHP's unserialize() function processing specially crafted input targeting SoapClient::__call() — flag unserialize() calls that produce SoapClient objects with non-array __default_headers ↗
- →The vulnerable code path is in ext/soap/soap.c within the SoapClient::__call method — patch or monitor PHP versions before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 ↗
- ·Red Hat Enterprise Linux 5 (php and php53 packages) will not receive a fix — deployments on RHEL5 remain permanently vulnerable ↗
- ·A related typo introduced in the fix commit c8eaca013a3922e8383def6158ece2b63f6ec483 was later corrected in PHP 5.5.40 — ensure the follow-up fix is also applied ↗
- ·A related information-leak issue (CVE-2015-4148) exists in the same code area, affecting URI handling in do_soap_call() — treat both CVEs together when assessing exposure ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015
Red Hat
php: SoapClient's __call() type confusion through unserialize()
vendor_redhat·2015-03-03·CVSS 7.5
CVE-2015-4147 [HIGH] CWE-843 php: SoapClient's __call() type confusion through unserialize()
php: SoapClient's __call() type confusion through unserialize()
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
Package: php (Red Hat Enterprise Linux 5) - Will not fix
Package: php53 (Red Hat Enterprise Linux 5) - Will not fix
Package: php54-php (Red Hat Software Collections) - Affected
Package: php5
Apple
CVE-2015-4147: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 7.5
CVE-2015-4147 [HIGH] CVE-2015-4147: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2015-4147
Component: CVE-2015-4147
GHSA
GHSA-qrgv-5qfv-5c76: The SoapClient::__call method in ext/soap/soap
ghsa_unreviewed·2022-05-14
CVE-2015-4147 [HIGH] GHSA-qrgv-5qfv-5c76: The SoapClient::__call method in ext/soap/soap
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
OSV
php5 vulnerabilities
osv·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] php5 vulnerabilities
php5 vulnerabilities
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015-4022,
CVE-2015-4643)
Shusheng Liu discovered that PHP inc
OSV
CVE-2015-4147: The SoapClient::__call method in ext/soap/soap
osv·2015-06-09·CVSS 7.5
CVE-2015-4147 [HIGH] CVE-2015-4147: The SoapClient::__call method in ext/soap/soap
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
No detection rules found.
No public exploits indexed.
arXiv
Towards Vulnerability Discovery Using Staged Program Analysis
arxiv_fulltext·2016-04-06
Towards Vulnerability Discovery Using Staged Program Analysis
Towards Vulnerability Discovery Using Staged Program Analysis
Bhargava Shastry1 Fabian Yamaguchi2
Konrad Rieck2
Jean-Pierre Seifert1
Security in Telecommunications, TU Berlin, Germany
Institute of System Security, TU Braunschweig, Germany
## Abstract
Eliminating vulnerabilities from low-level code is vital for securing software.
Static analysis is a promising approach for discovering vulnerabilities since it can provide developers early feedback on the code they write.
But, it presents multiple challenges not the least of which is understanding what makes a bug exploitable and conveying this information to the developer.
In this paper, we present the design and implementation of a practical vulnerability assessment framework, called .
performs data and control flow analysis to diagnos
Bugzilla
CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
bugzilla·2015-05-18·CVSS 9.8
CVE-2015-4599 [CRITICAL] CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
PHP versions 5.4.40, 5.5.24, and 5.6.8 provide a fix for type confusion vulnerability in unserialize() function used on a various SOAP methods.
Copy-paste description of the issue from the upstream bug:
"""
PHP_METHOD(SoapFault, __toString)
{
...
faultcode = zend_read_property(soap_fault_class_entry, this_ptr, "faultcode", sizeof("faultcode")-1, 1 TSRMLS_CC);
faultstring = zend_read_property(soap_fault_class_entry, this_ptr, "faultstring", sizeof("faultstring")-1, 1 TSRMLS_CC);
file = zend_read_property(soap_fault_class_entry, this_ptr, "file", sizeof("file")-1, 1 TSRMLS_CC);
line = zend_read_property(soap_fault_class_entry, this_ptr, "line", sizeof("line")-1, 1 TSRMLS_CC);
...
Bugzilla
CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()
bugzilla·2015-03-23·CVSS 7.5
CVE-2015-4147 [HIGH] CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()
CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()
SoapClient's __call() method is prone to a type confusion vulnerability which can be used to gain remote code execution through unsafe unserialize() calls.
Upstream bug:
https://bugs.php.net/bug.php?id=69085
Upstream commit:
http://git.php.net/?p=php-src.git;a=commitdiff;h=c8eaca013a3922e8383def6158ece2b63f6ec483
CVE request:
http://seclists.org/oss-sec/2015/q1/905
Discussion:
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1204869]
---
php-5.6.7-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
---
php-5.6.7-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.htmlhttp://openwall.com/lists/oss-security/2015/06/01/4http://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1053.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1066.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/73357http://www.securitytracker.com/id/1032459https://bugs.php.net/bug.php?id=69085https://security.gentoo.org/glsa/201606-10https://support.apple.com/kb/HT205031http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.htmlhttp://openwall.com/lists/oss-security/2015/06/01/4http://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1053.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1066.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/73357http://www.securitytracker.com/id/1032459https://bugs.php.net/bug.php?id=69085https://security.gentoo.org/glsa/201606-10https://support.apple.com/kb/HT205031
2015-06-09
Published