PHP Array Processing Error in Handling RFC1867 MIME Formatting May Let Remote Users Overwrite Memory
|
|
SecurityTracker Alert ID: 1011307
|
|
SecurityTracker URL: http://securitytracker.com/id?1011307
|
|
CVE Reference: CAN-2004-0959
(Links to External Site)
|
Updated: Oct 19 2004
|
Original Entry Date: Sep 16 2004
|
Impact: Modification of system information, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 5.0.1 and prior versions
|
Description: A vulnerability was reported in PHP in the processing of MIME data. A remote user may be able to cause memory to be overwritten.
Stefano Di Paola reported that there is an array processing error in the SAPI_POST_HANDLER_FUNC() function 'rfc1867.c'. A remote user may be able to cause the $_FILES array elements to be overwritten.
|
Impact: A remote user may be able to overwrite memory on the target system.
|
Solution: A fix is available via CVS at:
http://cvs.php.net/php-src/main/rfc1867.c
|
Vendor URL: www.php.net/ (Links to External Site)
|
Cause: Boundary error, Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Stefano Di Paola <stefano.dipaola@wisec.it>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 15 Sep 2004 19:07:37 +0200
From: Stefano Di Paola <stefano.dipaola@wisec.it>
Subject: [VulnWatch] Php Vulnerability N. 2
|
Let's go for the second one:
=========================================
Title: Overwrite $_FILE array in rfc1867 - Mime multipart/form-data File
Upload
Affected: Php <= 5.0.1
Not Affected: it seems none
Vulnerability Type: Possible write of a downloaded file in an arbitrary
location.
Vendor Status: Vendor has released a fix on cvs.php.net
==Summary:
Bad array parsing in rfc1867.c could lead to overwrite $_FILES array
elements.
==Description:
I don't know if releasing a POC for this vuln is a good thing because php is used widely in the net..
.
so if you are interested feel free to contact me.
==Solution:
Authors where contacted and they have released the patch
that can be found on the CVS
cvs.php.net
=================================================
Regards,
Stefano
-..----=oOOo=----=oOOo=---------
Stefano Di Paola
Software Engineer
stefano.dipaola_at_wisec_dot_it
stefano.dipaola1_at_tin_dot_it
-------------------------------
|
|
