PHP GD Extension Freed Resource Access Code Execution Vulnerability
BID:23046
Info
PHP GD Extension Freed Resource Access Code Execution Vulnerability
| Bugtraq ID: | 23046 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 19 2007 12:00AM |
| Updated: | Mar 20 2007 06:34PM |
| Credit: | Stefan Esser discovered this vulnerability. |
| Vulnerable: |
PHP PHP 5.2.1 PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 -RC1 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 5.0 .0 PHP PHP 4.4.6 PHP PHP 4.4.5 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 PHP PHP 4.3.9 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.2 -dev PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 PHP PHP 4.0.7 RC3 PHP PHP 4.0.7 RC2 PHP PHP 4.0.7 RC1 PHP PHP 4.0.7 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 pl1 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 PHP PHP 4.0 0 PHP PHP 5.2 |
| Not Vulnerable: | |
Discussion
PHP GD Extension Freed Resource Access Code Execution Vulnerability
PHP is prone to a locally exploitable arbitrary-code-execution vulnerability. This issue stems from a design error.
This issue affects functions from the GD extension. An attacker can execute arbitrary code by gaining access to freed memory and overwriting it with malicious data.
The researcher responsible for discovering this issue has indicated that other extensions may be vulnerable to this attack as well, but this has not been confirmed.
This issue affects PHP 4.x (4.4.6 and prior) as well as 5.x (5.2.1 and prior).
PHP is prone to a locally exploitable arbitrary-code-execution vulnerability. This issue stems from a design error.
This issue affects functions from the GD extension. An attacker can execute arbitrary code by gaining access to freed memory and overwriting it with malicious data.
The researcher responsible for discovering this issue has indicated that other extensions may be vulnerable to this attack as well, but this has not been confirmed.
This issue affects PHP 4.x (4.4.6 and prior) as well as 5.x (5.2.1 and prior).
Exploit / POC
PHP GD Extension Freed Resource Access Code Execution Vulnerability
An exploit is available.
An exploit is available.
Solution / Fix
PHP GD Extension Freed Resource Access Code Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
References
PHP GD Extension Freed Resource Access Code Execution Vulnerability
References:
References:
- MOPB-27-2007:PHP ext/gd Already Freed Resource Access Vulnerability (Stefan Esser)
- PHP Homepage (PHP)