bugtraq - PHP 5.2.x Remote Code Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAPuOwoKrAi7-ULUphU7-B4Le=1S+ipFXJK82h+JsJhe8UC0LnQ@mail.gmail.com>
Date: Fri, 17 Feb 2012 21:55:33 +0700
From: Worawit Wang <worawita@...il.com>
To: bugtraq@...urityfocus.com
Subject: PHP 5.2.x Remote Code Execution Vulnerability

Release Date: 17 February 2012
Affected Versions: 5.2.0 - 5.2.17 (unsupported version)

------------------------------------------------------------------------------------------

Description:

If PHP bails out in startup stage before setting PG(modules_activated)
to 1, the filter_globals struct is not cleaned up on shutdown stage.
The subsequence request will use uncleaned value in filter_globals
struct. With special crafted request, this problem can lead to
information disclosure and remote code execution.

Only apache modules SAPI are found to vulnerable to this problem.
While other SAPIs are safe because a PHP process exits when PHP bails
out before setting PG(modules_activated) to 1.

This bug was fixed before releasing 5.3.0.
http://svn.php.net/viewvc?view=revision&revision=279522. But the patch
is not backported to 5.2 version as described in
https://bugs.php.net/bug.php?id=47930.

------------------------------------------------------------------------------------------

Solution:

Upgrade to 5.3

------------------------------------------------------------------------------------------

Workaround:

If you still need to use PHP 5.2.x, I recommend to use cgi SAPI.

If you still need to use PHP 5.2.x as apache module, installing
Suhosin patch AND extension should help you.
Just only Suhosin patch, it still seems exploitable but much more difficult.

------------------------------------------------------------------------------------------

Vendor Response:

The final release of PHP 5.2 was in January 2011. We are not planning
any further releases.

Worawit Wangwarunyoo