PHP 5

tenable:101525 is a version-based finding for PHP 5.6.x before 5.6.31, published on 2017-07-06. The bundle includes multiple bugs across core PHP and bundled libraries: Oniguruma regex compilation/searching (CVE-2017-9224/9226/9227/9228/9229), unserialize() handling (CVE-2017-12933), INI parsing (CVE-2017-11628), WDDX parsing (CVE-2017-11143/11145), GD/PCRE memory issues, and a large-POST CPU DoS (CVE-2017-11142). The important catch: most of these are not generic “send one HTTP request to any PHP site and get RCE” bugs; they need a reachable application sink such as attacker-controlled regex compilation, unsafe deserialization, WDDX parsing, or unusual parser exposure.

The vendor baseline is inflated for enterprise patch triage because Tenable anchors on the worst-case CVSS from CVE-2017-9228 and explicitly says it did not test exploitability, only the self-reported PHP version. In real fleets, the decisive friction is that an attacker usually needs both an old runtime and a specific insecure app behavior; add distro backports and the version-only signal gets even noisier. That makes this a solid MEDIUM for most 10,000-host programs: fix it, but don’t let it jump ahead of proven one-click edge RCEs.

Why this verdict

• Requires an app sink, not just old PHP — most serious paths need attacker-controlled regex compilation, unsafe unserialize(), WDDX, or INI parsing. That means the vulnerability is usually post-discovery, pre-exploitation research work, not a one-request edge compromise.
• Version-only detection is noisy — Tenable says the plugin relies only on self-reported version. In real estates with Debian/Ubuntu/RHEL backports, that creates meaningful false urgency.
• Threat intel is cold — no KEV signal found and the representative EPSS exposed by Tenable for CVE-2017-9228 is only 0.00474. Public reproducers exist, but they are not the same thing as mass exploitation evidence.

Why not higher?

This is not a clean internet-edge RCE against every host running PHP 5.6.30. The attack almost always needs a second vulnerable condition inside the app, and several included bugs are more realistically DoS or memory-disclosure crashes than reliable code execution in hardened production workers.

Why not lower?

You still have an old PHP branch with real memory-corruption bugs and public technical reproducers. If one of your exposed apps feeds user input into the affected functions, the score moves from 'legacy noise' to 'legit incident material' quickly, so this does not belong in ignore/backlog limbo.

1. Suppress version leakage — Remove or mask X-Powered-By and related PHP banners so commodity scanners and opportunistic attackers lose the cheap fingerprint. At MEDIUM, there is no noisgate mitigation SLA; do this in the next normal hardening cycle while you work toward patching within the 365-day remediation window.
2. Hunt risky PHP sinks — Search code and configs for unserialize(, wddx_deserialize(, parse_ini_string(, and mb_ereg/mb_eregi usage with user-controlled patterns. This is the highest-value control because it tells you which hosts are merely old versus actually reachable; at MEDIUM, fold this into routine engineering work and complete it within the same remediation window.
3. Enforce request-size limits — Clamp oversized POST bodies at the reverse proxy and app server to reduce exposure to the large-POST CPU exhaustion bug (CVE-2017-11142). Use nginx client_max_body_size, Apache LimitRequestBody, and upstream timeouts; there is no mitigation SLA at this severity, so apply as part of normal web-tier hygiene.
4. Isolate and monitor PHP workers — Run apps in separate php-fpm pools or equivalent worker boundaries with sane restart policies, low privileges, and tight file permissions. That turns most failed parser exploitation into a contained worker recycle instead of a multi-app outage; again, no mitigation SLA at MEDIUM, but it should land before the patch deadline.

Run this on the target PHP host as a local validation check, not from your scanner. Invoke it as bash verify_php_5_6_31.sh with no special privileges required for the basic version test; package backport checks for Debian/Ubuntu use local package metadata if available.

#!/usr/bin/env bash
# verify_php_5_6_31.sh
# Purpose: determine whether the local PHP runtime is vulnerable to the upstream
# PHP < 5.6.31 bundle represented by Tenable plugin 101525.
#
# Output:
#   VULNERABLE - upstream PHP 5.6.x earlier than 5.6.31 and no known distro backport match found
#   PATCHED    - PHP not in affected range, or known distro-fixed package build detected
#   UNKNOWN    - PHP missing, version unreadable, or distro backport status cannot be determined confidently
#
# Exit codes:
#   0 PATCHED
#   1 VULNERABLE
#   2 UNKNOWN

set -u

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

command -v php >/dev/null 2>&1 || { echo "UNKNOWN: php binary not found"; exit 2; }

PHP_VER_RAW="$(php -r 'echo PHP_VERSION;' 2>/dev/null)"
if [ -z "$PHP_VER_RAW" ]; then
  echo "UNKNOWN: unable to read PHP_VERSION"
  exit 2
fi

PHP_VER="${PHP_VER_RAW%%-*}"

# Fast path: unaffected upstream versions
case "$PHP_VER" in
  5.6.*)
    if ver_lt "$PHP_VER" "5.6.31"; then
      :
    else
      echo "PATCHED: upstream PHP version $PHP_VER >= 5.6.31"
      exit 0
    fi
    ;;
  5.*)
    # Older non-5.6 branches are outside this specific plugin's affected range.
    echo "PATCHED: PHP version $PHP_VER is not in the plugin's 5.6.x < 5.6.31 range"
    exit 0
    ;;
  *)
    echo "PATCHED: PHP version $PHP_VER is newer than the plugin's affected branch"
    exit 0
    ;;
esac

# At this point, upstream-reported PHP is 5.6.x < 5.6.31.
# Check common distro backport cases before declaring vulnerable.
if command -v dpkg-query >/dev/null 2>&1; then
  PKG_VER="$(dpkg-query -W -f='${Version}\n' php5 2>/dev/null | head -n1)"
  if [ -n "$PKG_VER" ]; then
    case "$PKG_VER" in
      5.6.33+dfsg-0+deb8u1*|5.6.33+dfsg-0+deb8u2*|5.6.33+dfsg-0+deb8u3*|5.6.40+*)
        echo "PATCHED: Debian php5 package $PKG_VER includes fixes beyond upstream 5.6.31"
        exit 0
        ;;
      5.5.9+dfsg-1ubuntu4.22*|5.5.9+dfsg-1ubuntu4.23*|5.5.9+dfsg-1ubuntu4.24*)
        echo "PATCHED: Ubuntu php5 package $PKG_VER is a known fixed backport level"
        exit 0
        ;;
    esac
    echo "UNKNOWN: php reports $PHP_VER but distro package $PKG_VER may be backported; verify vendor errata"
    exit 2
  fi
fi

if command -v rpm >/dev/null 2>&1; then
  # Generic RPM check: many vendors backport without changing the upstream PHP_VERSION.
  RPM_PKG="$(rpm -q php php-cli php-common 2>/dev/null | tr '\n' ' ' | sed 's/  */ /g')"
  if [ -n "$RPM_PKG" ]; then
    echo "UNKNOWN: php reports $PHP_VER and RPM packages were found ($RPM_PKG). RPM-based distros often backport fixes; verify against local vendor errata before calling this vulnerable."
    exit 2
  fi
fi

echo "VULNERABLE: upstream PHP version $PHP_VER is in 5.6.x < 5.6.31 and no known backport match was detected"
exit 1

Sources

1. Tenable plugin 101525
2. PHP 5.6.31 release announcement
3. PHP 5 changelog entry for 5.6.31
4. NVD CVE-2017-9228
5. Oniguruma issue #60 reproducer
6. Ubuntu CVE-2017-9228 tracker
7. Debian tracker CVE-2017-12933
8. Red Hat RHSA-2018:1296