PHP Printf() Function 64bit Casting Multiple Format String Vulnerabilities
BID:23219
Info
PHP Printf() Function 64bit Casting Multiple Format String Vulnerabilities
| Bugtraq ID: | 23219 |
| Class: | Design Error |
| CVE: |
CVE-2007-1884 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 30 2007 12:00AM |
| Updated: | Jul 05 2007 11:27PM |
| Credit: | Stefan Esser is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 -RC1 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 5.0 .0 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 PHP PHP 4.3.9 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.2 -dev PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 PHP PHP 4.0.7 RC3 PHP PHP 4.0.7 RC2 PHP PHP 4.0.7 RC1 PHP PHP 4.0.7 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 pl1 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 PHP PHP 4.0 0 PHP PHP 5.2 HP Tru64 UNIX Compaq Secure Web Server 6.3.2 a HP Tru64 UNIX Compaq Secure Web Server 6.3 HP Tru64 UNIX Compaq Secure Web Server 5.9.2 HP Tru64 UNIX Compaq Secure Web Server 5.9.1 HP Tru64 UNIX Compaq Secure Web Server 5.8.2 HP Tru64 UNIX Compaq Secure Web Server 5.8.1 HP Tru64 UNIX Compaq Secure Web Server 5.1 A HP Tru64 UNIX Compaq Secure Web Server 5.1 HP Tru64 UNIX Compaq Secure Web Server 5.0 A HP Tru64 UNIX Compaq Secure Web Server 4.0 G HP Tru64 UNIX Compaq Secure Web Server 4.0 F HP Systems Management HomePage 2.1.7.168 HP System Management Homepage 2.1.5 HP System Management Homepage 2.1.4 HP System Management Homepage 2.1.3 .132 HP System Management Homepage 2.1.3 HP System Management Homepage 2.1.2 HP System Management Homepage 2.1.1 HP System Management Homepage 2.1 HP System Management Homepage 2.0.2 HP System Management Homepage 2.0.1 HP System Management Homepage 2.0 HP Secure Web Server for HP Tru64 UNIX 6.6.4 HP Internet Express 6.0 HP Internet Express 5.9 HP Internet Express 5.8 HP Internet Express 5.7 HP Internet Express 5.4 HP Internet Express 6.6 HP Internet Express 6.4 HP Internet Express 6.3 |
| Not Vulnerable: |
PHP PHP 5.2.1 PHP PHP 4.4.5 HP Systems Management HomePage 2.1.8 HP Internet Express 6.7 |
Discussion
PHP Printf() Function 64bit Casting Multiple Format String Vulnerabilities
PHP is prone to multiple format-string vulnerabilities due to a design error when casting 64-bit variables to 32 bits.
Attackers may be able to exploit these issues to execute arbitrary code in the context of the webserver process or to cause denial-of-service conditions.
These issues affect PHP versions prior to 4.4.5 and 5.2.1 running on 64-bit computers.
PHP is prone to multiple format-string vulnerabilities due to a design error when casting 64-bit variables to 32 bits.
Attackers may be able to exploit these issues to execute arbitrary code in the context of the webserver process or to cause denial-of-service conditions.
These issues affect PHP versions prior to 4.4.5 and 5.2.1 running on 64-bit computers.
Exploit / POC
PHP Printf() Function 64bit Casting Multiple Format String Vulnerabilities
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution / Fix
PHP Printf() Function 64bit Casting Multiple Format String Vulnerabilities
Solution:
The vendor released versions 5.2.1 and 4.4.5 to address these issues. Please see the references for more information.
HP Systems Management HomePage 2.1.7.168
HP Secure Web Server for HP Tru64 UNIX 6.6.4
Solution:
The vendor released versions 5.2.1 and 4.4.5 to address these issues. Please see the references for more information.
HP Systems Management HomePage 2.1.7.168
-
HP HP System Management Homepage for Linux
http://h18023.www1.hp.com/support/files/server/us/download/26864.html -
HP HP System Management Homepage for Linux (AMD64/EM64T)
http://h18023.www1.hp.com/support/files/server/us/download/26866.html -
HP HP System Management Homepage for Windows
http://h18023.www1.hp.com/support/files/server/us/download/26977.html
HP Secure Web Server for HP Tru64 UNIX 6.6.4
-
HP sws_v6_6_5_kit.tar.gz
http://h30097.www3.hp.com/internet/download.htm#sws
References
PHP Printf() Function 64bit Casting Multiple Format String Vulnerabilities
References:
References:
- HPSBMA02215 SSRT071423 (HP)
- MOPB-38-2007:PHP printf() Family 64 Bit Casting Vulnerabilities (Stefan Esser)
- PHP 4.4.5 Release Announcement (PHP)
- PHP 5.2.1 Release Announcement (PHP)
- PHP Homepage (PHP)