PHP Chunk_Split() Function Integer Overflow Vulnerability

TITLE: PHP Chunk_Split() Function Integer Overflow Vulnerability
CLASS: Boundary Condition Error
CVE: CVE-2007-2872

REMOTE: Yes
LOCAL: No
PUBLISHED: May 31 2007 12:00AM
UPDATE: Jun 04 2007 05:30PM
CREDIT: Gerhard Wagner found this vulnerability.
VULNERABLE:

Slackware Linux 10.2
Slackware Linux 11.0
Slackware Linux -current
PHP PHP 5.2.2
PHP PHP 5.2.1
+ Ubuntu Ubuntu Linux 7.04 sparc
+ Ubuntu Ubuntu Linux 7.04 powerpc
+ Ubuntu Ubuntu Linux 7.04 i386
+ Ubuntu Ubuntu Linux 7.04 amd64
PHP PHP 5.1.6
+ Ubuntu Ubuntu Linux 6.10 sparc
+ Ubuntu Ubuntu Linux 6.10 powerpc
+ Ubuntu Ubuntu Linux 6.10 i386
+ Ubuntu Ubuntu Linux 6.10 amd64
PHP PHP 5.1.5
PHP PHP 5.1.4
PHP PHP 5.1.3
PHP PHP 5.1.3
PHP PHP 5.1.2
+ Ubuntu Ubuntu Linux 6.06 LTS sparc
+ Ubuntu Ubuntu Linux 6.06 LTS powerpc
+ Ubuntu Ubuntu Linux 6.06 LTS i386
+ Ubuntu Ubuntu Linux 6.06 LTS amd64
PHP PHP 5.1.1
PHP PHP 5.1
PHP PHP 5.0.5
PHP PHP 5.0.4
PHP PHP 5.0.3
+ Trustix Secure Linux 2.2
PHP PHP 5.0.2
PHP PHP 5.0.1
PHP PHP 5.0 candidate 3
PHP PHP 5.0 candidate 2
PHP PHP 5.0 candidate 1
PHP PHP 5.0 .0
PHP PHP 5.2
+ Debian Linux 4.0 sparc
+ Debian Linux 4.0 s/390
+ Debian Linux 4.0 powerpc
+ Debian Linux 4.0 mipsel
+ Debian Linux 4.0 mips
+ Debian Linux 4.0 m68k
+ Debian Linux 4.0 ia-64
+ Debian Linux 4.0 ia-32
+ Debian Linux 4.0 hppa
+ Debian Linux 4.0 arm
+ Debian Linux 4.0 amd64
+ Debian Linux 4.0 alpha
+ Debian Linux 4.0
OpenPKG OpenPKG E1.0-Solid
OpenPKG OpenPKG Current
NOT VULNERABLE:
PHP PHP 5.2.3

Vai alla pagina originale su Security Focus

Discussion

PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a buffer overflow and to corrupt process memory.

Attackers may be able to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in a denial-of-service condition.

This issue affects versions of PHP prior to 5.2.3.

Exploit

The following proof of concept is available:

Solution

Solution:
The vendor has released PHP 5.2.3 to address this and other issues. Please see the references for more information.


Slackware Linux -current


Slackware Linux 11.0

PHP PHP 5.2

Slackware Linux 10.2

PHP PHP 5.0 candidate 2

PHP PHP 5.0 .0

PHP PHP 5.0 candidate 3

PHP PHP 5.0 candidate 1

PHP PHP 5.0.1

PHP PHP 5.0.2

PHP PHP 5.0.3

PHP PHP 5.0.4

PHP PHP 5.0.5

PHP PHP 5.1

PHP PHP 5.1.1

PHP PHP 5.1.2

PHP PHP 5.1.3

PHP PHP 5.1.3

PHP PHP 5.1.4

PHP PHP 5.1.5

PHP PHP 5.1.6

PHP PHP 5.2.1

PHP PHP 5.2.2

References

References:

PhpLog

BNLug Benevento Linux Users Group