PHP Session Identifier Rejection Double Free Memory Corruption Vulnerability
BID:22971
Info
PHP Session Identifier Rejection Double Free Memory Corruption Vulnerability
| Bugtraq ID: | 22971 |
| Class: | Design Error |
| CVE: |
CVE-2007-1522 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 15 2007 12:00AM |
| Updated: | May 23 2007 11:58PM |
| Credit: | Stefan Esser is credited with the discovery of this vulnerability. |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise SDK 10 SuSE Linux Professional 10.2 x86_64 SuSE Linux Personal 10.2 x86_64 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Openexchange Server S.u.S.E. Linux Enterprise Server 9 S.u.S.E. Linux Enterprise Server 10 S.u.S.E. Linux 9.3 x86-64 S.u.S.E. Linux 9.3 x86 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc PHP PHP 5.2.1 PHP PHP 5.2 |
| Not Vulnerable: | |
Discussion
PHP Session Identifier Rejection Double Free Memory Corruption Vulnerability
PHP is prone to a double-free memory-corruption vulnerability.
Attackers may be able to exploit this issue to execute arbitrary code in the context of the webserver process or to cause denial-of-service conditions.
This issue is proven to be locally exploitable. Remote attack vectors may also be possible, but this is yet to be confirmed.
This issue affects PHP versions 5.2.0 and 5.2.1.
PHP is prone to a double-free memory-corruption vulnerability.
Attackers may be able to exploit this issue to execute arbitrary code in the context of the webserver process or to cause denial-of-service conditions.
This issue is proven to be locally exploitable. Remote attack vectors may also be possible, but this is yet to be confirmed.
This issue affects PHP versions 5.2.0 and 5.2.1.
Exploit / POC
PHP Session Identifier Rejection Double Free Memory Corruption Vulnerability
The following proof of concept is available:
The following proof of concept is available:
Solution / Fix
PHP Session Identifier Rejection Double Free Memory Corruption Vulnerability
Solution:
Please see the references for more information.
Solution:
Please see the references for more information.
References
PHP Session Identifier Rejection Double Free Memory Corruption Vulnerability
References:
References: