PHP 'SoapClient's __call()' Function Type Confusion Remote Code Execution Vulnerability
BID:73357
Info
PHP 'SoapClient's __call()' Function Type Confusion Remote Code Execution Vulnerability
| Bugtraq ID: | 73357 |
| Class: | Unknown |
| CVE: |
CVE-2015-4147 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 17 2015 12:00AM |
| Updated: | Jul 06 2016 12:22PM |
| Credit: | Andrea Palazzo |
| Vulnerable: |
Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 PHP PHP 5.4.3 PHP PHP 5.4.2 PHP PHP 5.4.1 PHP PHP 5.3.13 PHP PHP 5.3.12 PHP PHP 5.3.9 PHP PHP 5.3.8 PHP PHP 5.3.7 PHP PHP 5.3.6 PHP PHP 5.3.5 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.2.17 PHP PHP 5.2.15 PHP PHP 5.2.13 PHP PHP 5.2.12 PHP PHP 5.2.11 PHP PHP 5.2.10 PHP PHP 5.2.9 -2 PHP PHP 5.2.9 PHP PHP 5.2.8 PHP PHP 5.2.7 PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4 PHP PHP 5.2.3 PHP PHP 5.2.2 PHP PHP 5.2.1 PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 .0 PHP PHP 4.4.9 PHP PHP 4.4.8 PHP PHP 4.4.7 PHP PHP 4.4.6 PHP PHP 4.4.5 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 PHP PHP 4.3.9 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 PHP PHP 4.0.7 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 PHP PHP 4.0 0 PHP PHP 3.0.18 PHP PHP 3.0.17 PHP PHP 3.0.16 PHP PHP 3.0.15 PHP PHP 3.0.14 PHP PHP 3.0.13 PHP PHP 3.0.12 PHP PHP 3.0.11 PHP PHP 3.0.10 PHP PHP 3.0.9 PHP PHP 3.0.8 PHP PHP 3.0.7 PHP PHP 3.0.6 PHP PHP 3.0.5 PHP PHP 3.0.4 PHP PHP 3.0.3 PHP PHP 3.0.2 PHP PHP 3.0.1 PHP PHP 3.0 0 PHP PHP 3.0 .16 PHP PHP 3.0 .13 PHP PHP 3.0 .12 PHP PHP 3.0 .11 PHP PHP 3.0 .10 PHP PHP 6.0 PHP PHP 5.3.4 PHP PHP 5.3.3 PHP PHP 5.3.11 PHP PHP 5.3.10 PHP PHP 5.2.14 PHP PHP 5.2 |
| Not Vulnerable: | |
Discussion
PHP 'SoapClient's __call()' Function Type Confusion Remote Code Execution Vulnerability
PHP is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause a denial-of-service condition.
PHP is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause a denial-of-service condition.
Solution / Fix
PHP 'SoapClient's __call()' Function Type Confusion Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
PHP 'SoapClient's __call()' Function Type Confusion Remote Code Execution Vulnerability
References:
References:
- PHP Homepage (PHP)
- SoapClient's __call() type confusion through unserialize() (PHP)
- APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006 (Apple)
- Oracle Linux Bulletin - January 2016 (Oracle)
- Security Advisory - AlienVault v5.2 addresses 55 vulnerabilities (AlienVault)
- Security Advisory Important: php security and bug fix update (Redhat)
- Security Bulletin: Multiple vulnerabilities in php affect IBM Flex System Manger (IBM)