lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 01 Apr 2003 12:29:57 +0000 From: Sir Mordred <mordred@...ail.com> To: bugtraq@...urityfocus.com Subject: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function //@(#) Mordred Security Labs advisory Release date: April 1, 2003 Name: Integer overflow in PHP str_repeat() function Versions affected: all versions Risk: average Author: Sir Mordred (mordred@...ail.com) I. Description: PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Please visit http://www.php.net for more information about PHP. II. Details: The function str_repeat(string input, int multiplier) returns input repeated multiplier times. The implementation of this function suffers from a simple integer overflow caused by a very long second argument and could allow a local/remote attacker in the worst case to gain control over the web server. The following short script will illustrate this vulnerability: $ cat t.php <?php str_repeat(str_repeat("A", 0x2000), 0x40000000); ?> III. Platforms tested Linux 2.4 with Apache 1.3.27 / PHP 4.3.1 IV. Vendor response Vendor has been contacted. ________________________________________________________________________ This letter has been delivered unencrypted. We'd like to remind you that the full protection of e-mail correspondence is provided by S-mail encryption mechanisms if only both, Sender and Recipient use S-mail. Register at S-mail.com: http://www.s-mail.com
Powered by blists - more mailing lists