SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PHP Vendors:   PHP Group
PHP zend_hash_del_key_or_index() May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016649
SecurityTracker URL:  http://securitytracker.com/id/1016649
CVE Reference:   CVE-2006-3017   (Links to External Site)
Updated:  Jan 30 2007
Original Entry Date:  Aug 8 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): prior to 4.4.3 and 5.1.4
Description:   A vulnerability was reported in PHP in the zend_hash_del_key_or_index() function. A remote user may be able to execute arbitrary code on the target system.

The zend_hash_del_key_or_index() function does not correctly delete bucket elements in a hash table. When a numeric index hash value is the same as an alphanumeric index hash value, the system may delete the wrong element in the array. Depending on the PHP functions used by the target PHP application, this may allow arbitrary code to be executed.

PHP functions that use the Zend hash table implementation are affected. In particular, the unset() function is affected and may not properly unset variables.

Applications such as miniBB, phpBB, and Wordpress are affected.

The original advisory is available at:

http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html

Stefan Esser reported this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   The vendor has issued a fixed version (4.4.3 and 5.1.4), available at:

http://www.php.net/downloads.php

Vendor URL:  www.php.net/ (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  PHP: Zend_Hash_Del_Key_Or_Index Vulnerability

Hello,

word about this vulnerability is out for several weeks (or months). Because of this I spare you the
advisory and only point you to my little article describing what exactly this vulnerability is,
that I disclosed to the PHP project 6 months ago:

The rating for this vulnerability should be: Very Critical

http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html

Greets,
Stefan Esser


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC