bugtraq - Php Vulnerability N. 2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 15 Sep 2004 19:07:37 +0200
From: Stefano Di Paola <stefano.dipaola@...ec.it>
To: Bugtraq <bugtraq@...urityfocus.com>
Cc: vulnwatch <vulnwatch@...nwatch.org>
Subject: Php Vulnerability N. 2

Let's go for the second one:

=========================================
Title: Overwrite $_FILE array in rfc1867 - Mime multipart/form-data File
Upload 

Affected: Php <= 5.0.1
Not Affected: it seems none
Vulnerability Type:  Possible write of a downloaded file in an arbitrary
                     location.
Vendor Status: Vendor has released a fix on cvs.php.net

==Summary:

Bad array parsing in rfc1867.c could lead to overwrite $_FILES array
elements.

==Description:

I don't know if releasing a POC for this vuln is a good thing because php is used widely in the net...
so if you are interested feel free to contact me.

==Solution: 
Authors where contacted and they have released the patch
that can be found on the CVS
cvs.php.net

=================================================

Regards,

Stefano

-..----=oOOo=----=oOOo=---------
Stefano Di Paola
Software Engineer

stefano.dipaola_at_wisec_dot_it
stefano.dipaola1_at_tin_dot_it
-------------------------------