PHP 5

Tenable plugin 109576 flags PHP 5.6.x < 5.6.36 and rolls up four CVEs fixed on 2018-04-26: CVE-2018-10546 (iconv infinite-loop DoS), CVE-2018-10548 (LDAP NULL dereference / crash), CVE-2018-10547 (PHAR reflected XSS on 403/404 pages), and CVE-2018-10549 (EXIF out-of-bounds read while parsing crafted JPEG metadata). Upstream fix is 5.6.36; distro backports also exist, including Debian Jessie 5.6.36+dfsg-0+deb8u1.

The scanner's headline severity overstates operational risk. The highest-score CVSS vector comes from the EXIF bug, but in real deployments an attacker still needs an application to feed attacker-controlled content into a vulnerable PHP code path like exif_read_data() or the convert.iconv stream filter; the LDAP bug needs a malicious backend server, and the PHAR issue needs user interaction. That is very different from a one-request unauthenticated server takeover.

Why this verdict

• Down from 8.8 because the lead CVE is not a turnkey takeover: the score is anchored to CVE-2018-10549, an EXIF out-of-bounds read, but real exploitation still needs an app to parse attacker-supplied image metadata with exif_read_data().
• More downward pressure from attacker position and app reachability: CVE-2018-10548 effectively needs a malicious LDAP backend, CVE-2018-10546 needs a specific iconv stream-filter code path, and CVE-2018-10547 needs user interaction on a .phar error page.
• Remote population is narrower than the plugin suggests: Tenable 109576 is a remote banner check, so reverse proxies, backported distro packages, and suppressed headers all distort the true vulnerable set.

Why not higher?

There is no strong evidence here of a one-shot unauthenticated RCE, no CISA KEV listing, and Tenable explicitly says no known exploits are available. If you manage 10,000 hosts, this should not outrank genuinely weaponized web-edge bugs.

Why not lower?

This is still internet-adjacent application code on a legacy PHP branch, and image-processing plus file-upload workflows are common. If a public-facing site really does exercise EXIF or iconv on untrusted input, the bug becomes materially more interesting than background hygiene.

1. Validate locally before escalating — Run a local package/version check on flagged hosts first, because this plugin is banner-driven and false positives from distro backports are common. For a MEDIUM verdict there is no mitigation SLA; do this during normal validation and use the result to cut the queue.
2. Constrain risky parsing paths — If the host is truly on vulnerable PHP, review whether apps process untrusted JPEG metadata with exif_read_data(), use convert.iconv on attacker-controlled streams, or expose .phar request paths. For MEDIUM, there is no mitigation SLA; fold this into the same application-hardening workstream used for normal change windows.
3. Limit PHP extension surface — Disable unused extensions like ldap or exif in pools that do not need them, and remove unnecessary PHAR handling from public request paths. This reduces reachable sinks without waiting for a full application rewrite; for MEDIUM there is no mitigation SLA.
4. Prefer supported runtimes over point fixes — If you confirm vulnerable 5.6.x, do not stop at proving 5.6.36; move the service onto a still-supported PHP branch in the normal remediation program. For MEDIUM, there is no mitigation SLA; use the remediation window to retire the legacy runtime cleanly.

Run this on the target Linux host after logging in with shell access; root is helpful for package queries but not strictly required if php is in PATH. Invoke it as bash verify-php-109576.sh or bash verify-php-109576.sh /opt/cpanel/ea-php56/root/usr/bin/php; it checks the local binary first, then known Debian/package backports, and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# verify-php-109576.sh
# Checks whether a Linux host is still vulnerable to Tenable plugin 109576
# (PHP 5.6.x < 5.6.36 multiple vulnerabilities) using local evidence.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

PHP_BIN="${1:-php}"

say() { printf "%s\n" "$1"; }

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_lt() {
  # Returns 0 if $1 < $2 using dpkg if present, else sort -V fallback
  if have_cmd dpkg; then
    dpkg --compare-versions "$1" lt "$2"
    return $?
  fi
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

ver_ge() {
  if have_cmd dpkg; then
    dpkg --compare-versions "$1" ge "$2"
    return $?
  fi
  ! ver_lt "$1" "$2"
}

check_dpkg_backports() {
  if ! have_cmd dpkg-query; then
    return 1
  fi

  # Debian Jessie php5 backport fix level from DLA-1397-1
  if dpkg-query -W -f='${Version}' php5 2>/dev/null | grep -q .; then
    pkgver="$(dpkg-query -W -f='${Version}' php5 2>/dev/null)"
    if dpkg --compare-versions "$pkgver" ge '5.6.36+dfsg-0+deb8u1'; then
      say "PATCHED: Debian php5 package version $pkgver includes the fixed level (>= 5.6.36+dfsg-0+deb8u1)."
      exit 0
    fi
  fi

  return 1
}

check_php_binary() {
  if ! have_cmd "$PHP_BIN"; then
    return 1
  fi

  raw="$("$PHP_BIN" -r 'echo PHP_VERSION;' 2>/dev/null || true)"
  if [ -z "$raw" ]; then
    return 1
  fi

  base="${raw%%-*}"
  major_minor_patch="$(printf '%s' "$base" | awk -F. '{print $1"."$2"."$3}')"
  series="$(printf '%s' "$base" | awk -F. '{print $1"."$2}')"

  if [ "$series" != "5.6" ]; then
    say "PATCHED: local PHP reports version $raw; plugin 109576 only applies to 5.6.x < 5.6.36."
    exit 0
  fi

  if ver_lt "$major_minor_patch" '5.6.36'; then
    say "VULNERABLE: local PHP reports version $raw (< 5.6.36)."
    exit 1
  fi

  say "PATCHED: local PHP reports version $raw (>= 5.6.36)."
  exit 0
}

check_rpm_hint() {
  if ! have_cmd rpm; then
    return 1
  fi

  # Best-effort only: RPM packaging/versioning varies heavily across vendors.
  for pkg in php php-cli php-fpm php-cgi php56-php php56-php-cli ea-php56 ea-php56-php-cli alt-php56-cli; do
    if rpm -q "$pkg" >/dev/null 2>&1; then
      nevra="$(rpm -q --qf '%{NAME} %{VERSION}-%{RELEASE}\n' "$pkg" 2>/dev/null | head -n1)"
      say "UNKNOWN: RPM package detected ($nevra). Verify vendor backports locally; remote banner checks are not authoritative on RPM-based systems."
      exit 2
    fi
  done

  return 1
}

check_dpkg_backports
check_php_binary
check_rpm_hint

say "UNKNOWN: could not validate a local PHP 5.6 binary or a known distro package backport."
exit 2

Sources

1. Tenable plugin 109576
2. PHP 5 ChangeLog
3. NVD CVE-2018-10549
4. NVD CVE-2018-10547
5. Ubuntu CVE-2018-10549
6. Debian tracker CVE-2018-10546
7. CISA Known Exploited Vulnerabilities Catalog
8. Shodan CVEDB CVE-2018-10546