full-disclosure - PHP Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <8DECAE5E24A8D31193F300508B10DFEB01791D6C@bna2.digimed.com>
From: Paul.Tinsley at phyve.com (Paul Tinsley)
Subject: PHP Exploit

Sorry if this was already posted but, this is a serious vulnerability given
the wide spread use of PHP, and the plenty of people that have it on by
default that don't actually use it.

For those that are familiar with http://www.apachetoolbox.com, a build tool
for apache, It was patched at 8:46 this morning:

v1.5.59		07/22/02
		PDFLib patch sent in by Dominique Massonie. Updated PHP
		to v4.2.2.

Venerability Text from PHP site:

http://www.php.net/release_4_2_2.php

Issued on:    July 22, 2002 
Software:    PHP versions 4.2.0 and 4.2.1 
Platforms:    All 

The PHP Group has learned of a serious security vulnerability in PHP
versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code
with the privileges of the web server. This vulnerability may be exploited
to compromise the web server and, under certain conditions, to gain
privileged access.

Description
PHP contains code for intelligently parsing the headers of HTTP POST
requests. The code is used to differentiate between variables and files sent
by the user agent in a "multipart/form-data" request. This parser has
insufficient input checking, leading to the vulnerability.

The vulnerability is exploitable by anyone who can send HTTP POST requests
to an affected web server. Both local and remote users, even from behind
firewalls, may be able to gain privileged access.

Impact
Both local and remote users may exploit this vulnerability to compromise the
web server and, under certain conditions, to gain privileged access. So far
only the IA32 platform has been verified to be safe from the execution of
arbitrary code. The vulnerability can still be used on IA32 to crash PHP
and, in most cases, the web server.

Solution
The PHP Group has released a new PHP version, 4.2.2, which incorporates a
fix for the vulnerability. All users of affected PHP versions are encouraged
to upgrade to this latest version. The downloads web site at 

http://www.php.net/downloads.php
has the new 4.2.2 source tarballs, Windows binaries and source patches from
4.2.0 and 4.2.1 available for download.

Workaround
If the PHP applications on an affected web server do not rely on HTTP POST
input from user agents, it is often possible to deny POST requests on the
web server.

In the Apache web server, for example, this is possible with the following
code included in the main configuration file or a top-level .htaccess file: 

<Limit POST>
   Order deny,allow
   Deny from all
</Limit>

Note that an existing configuration and/or .htaccess file may have
parameters contradicting the example given above.

Credits
The PHP Group would like to thank Stefan Esser of e-matters GmbH for
discovering this vulnerability. e-matters GmbH has also released an
independent advisory, describing the vulnerability in more detail.

--
Paul Tinsley
paul.tinsley@...ve.com