bugtraq - Inaccurate Reports Concerning PHP Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <48270-22003432026175@M2W098.mail2web.com>
Date: Tue, 1 Apr 2003 19:26:17 -0500
From: "mattmurphy@...rr.com" <mattmurphy@...rr.com>
To: bugtraq@...urityfocus.com
Subject: Inaccurate Reports Concerning PHP Vulnerabilities

There have been a number of reports circulating about possible
vulnerabilities in PHP.  I'm going to address them one-by-one:

* Integer Overflow in socket_iovec_alloc()

WRONG!  This is a Null-pointer de-reference:

EAX = 00000000
EDI = 41414141

0085353A 8B 38                mov         edi,dword ptr [eax]

The access violation occurs in a read error.  This is not exploitable to
gain control of the PHP interpreter, nor is it an integer overflow of any
kind.  It is simply a null-read, and the lone register controlled by user
data is obliterated by that instruction if the call succeeds.

* Buffer overflow in openlog()

I've tried passing long parameters (and large integers) to openlog().  No
crashes could be caused by this "exploit".  I was unable to demonstrate any
disruption to PHP via this "vulnerability", let alone complete control. 
Unless the vendor or the original reporter will confirm this with code
(which was, oddly enough, MISSING from the original advisory), I don't
believe this "flaw" (if it exists) can do any damage to a default
production system.

* Integer overflow in emalloc()

Funny -- there is not an emalloc() function (nor malloc, calloc, etc.)
because ALL memory allocation is handled by the interpreter itself. 
Therefore, this report is completely bogus.

--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .