PHP MySQLI Error Logging Remote Format String Vulnerability
BID:16219
Info
PHP MySQLI Error Logging Remote Format String Vulnerability
| Bugtraq ID: | 16219 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 12 2006 12:00AM |
| Updated: | Jan 12 2006 12:00AM |
| Credit: | Stefan Esser <[email protected]> discovered this vulnerability. |
| Vulnerable: |
PHP PHP 5.1.1 PHP PHP 5.1 |
| Not Vulnerable: |
PHP PHP 5.1.2 |
Discussion
PHP MySQLI Error Logging Remote Format String Vulnerability
PHP is susceptible to a remote format string vulnerability in the 'mysqli' extension. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it in the format-specifier argument to a formatted printing function.
This issue allows attackers to execute arbitrary machine code in the context of the Web server hosting the PHP interpreter.
This issue affects PHP 5.1.0, and 5.1.1.
PHP is susceptible to a remote format string vulnerability in the 'mysqli' extension. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it in the format-specifier argument to a formatted printing function.
This issue allows attackers to execute arbitrary machine code in the context of the Web server hosting the PHP interpreter.
This issue affects PHP 5.1.0, and 5.1.1.
Exploit / POC
PHP MySQLI Error Logging Remote Format String Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
PHP MySQLI Error Logging Remote Format String Vulnerability
Solution:
The vendor has released PHP version 5.1.2 to address this, and other issues:
PHP PHP 5.1
PHP PHP 5.1.1
Solution:
The vendor has released PHP version 5.1.2 to address this, and other issues:
PHP PHP 5.1
-
PHP php-5.1.2.tar.bz2
http://www.php.net/get/php-5.1.2.tar.bz2/from/a/mirror
PHP PHP 5.1.1
-
PHP php-5.1.2.tar.bz2
http://www.php.net/get/php-5.1.2.tar.bz2/from/a/mirror
References
PHP MySQLI Error Logging Remote Format String Vulnerability
References:
References:
- PHP 5.1.2. Release Announcement (PHP)
- PHP Homepage (PHP)
- Advisory 02/2006: PHP ext/mysqli Format String Vulnerability (Stefan Esser