PHP zend_hash_del_key_or_index() May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016649 |
|
SecurityTracker URL: http://securitytracker.com/id/1016649
|
|
CVE Reference:
CVE-2006-3017
(Links to External Site)
|
Updated: Jan 30 2007
|
Original Entry Date: Aug 8 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): prior to 4.4.3 and 5.1.4
|
Description:
A vulnerability was reported in PHP in the zend_hash_del_key_or_index() function. A remote user may be able to execute arbitrary code on the target system.
The zend_hash_del_key_or_index() function does not correctly delete bucket elements in a hash table. When a numeric index hash value is the same as an alphanumeric index hash value, the system may delete the wrong element in the array. Depending on the PHP functions used by the target PHP application, this may allow arbitrary code to be executed.
PHP functions that use the Zend hash table implementation are affected. In particular, the unset() function is affected and may not properly unset variables.
Applications such as miniBB, phpBB, and Wordpress are affected.
The original advisory is available at:
http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html
Stefan Esser reported this vulnerability.
|
Impact:
A remote user can execute arbitrary code on the target system.
|
Solution:
The vendor has issued a fixed version (4.4.3 and 5.1.4), available at:
http://www.php.net/downloads.php
|
Vendor URL: www.php.net/ (Links to External Site)
|
Cause:
State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Subject: PHP: Zend_Hash_Del_Key_Or_Index Vulnerability
|
Hello,
word about this vulnerability is out for several weeks (or months). Because of this I spare you the
advisory and only point you to my little article describing what exactly this vulnerability is,
that I disclosed to the PHP project 6 months ago:
The rating for this vulnerability should be: Very Critical
http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html
Greets,
Stefan Esser
|
|
