Man-in-the-middle attack in PHP - CVE-2018-10548

Vulnerability identifier: #VU12256

CSH Severity: Low

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10548

CWE-ID: CWE-300

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the ext/ldap/ldap.c source code file due to improper handling of return values from the ldap_get_dn function. A remote attacker can use man-in-the middle techniques to trigger ldap_get_dn() to return a NULL pointer and cause ldap_get_entries() because add_assoc_string() to crash.

PHP
Amazon Linux AMI
Gentoo Linux
Debian Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
SUSE Linux
Slackware Linux
Fedora
Opensuse
php7 (Alpine package)
openSUSE Leap
php
Flex System Chassis Management Module (CMM)

The vulnerability is addressed in the following versions: 5.6.36, 7.1.17, 7.2.5 and 7.0.30.

php7 (Alpine package) - update to 7.1.30-r0
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
php - addressed in versions 7.1.17-1.fc26, 7.1.17-1.fc27, 7.2.5-1.fc28

• https://bugs.php.net/bug.php?id=76248

• Multiple vulnerabilities in PHP
• SUSE Linux update for php7
• OpenSUSE Linux update for php7
• Amazon Linux AMI update for php56, php70, php71
• Slackware Linux update for php
• OpenSUSE Linux update for php5
• Debian update for php7.0
• Gentoo update for PHP
• Red Hat update for 389-ds-base
• Red Hat update for 389-ds-base
• Man-in-the-middle attack in php7 (Alpine package)
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 28 update for php
• Fedora 27 update for php
• Fedora 26 update for php