PHP Str_Replace() Integer Overflow Vulnerability
BID:23233
Info
PHP Str_Replace() Integer Overflow Vulnerability
| Bugtraq ID: | 23233 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-1885 CVE-2007-1886 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 31 2007 12:00AM |
| Updated: | Jun 29 2007 04:38PM |
| Credit: | Stefan Esser is credited with the discovery of this vulnerability. |
| Vulnerable: |
PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 -RC1 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 5.0 .0 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 PHP PHP 4.3.9 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.2 -dev PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 PHP PHP 4.0.7 RC3 PHP PHP 4.0.7 RC2 PHP PHP 4.0.7 RC1 PHP PHP 4.0.7 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 pl1 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 PHP PHP 4.0 0 PHP PHP 5.2 HP Tru64 UNIX Compaq Secure Web Server 6.3.2 a HP Tru64 UNIX Compaq Secure Web Server 6.3 HP Tru64 UNIX Compaq Secure Web Server 5.9.2 HP Tru64 UNIX Compaq Secure Web Server 5.9.1 HP Tru64 UNIX Compaq Secure Web Server 5.8.2 HP Tru64 UNIX Compaq Secure Web Server 5.8.1 HP Tru64 UNIX Compaq Secure Web Server 5.1 A HP Tru64 UNIX Compaq Secure Web Server 5.1 HP Tru64 UNIX Compaq Secure Web Server 5.0 A HP Tru64 UNIX Compaq Secure Web Server 4.0 G HP Tru64 UNIX Compaq Secure Web Server 4.0 F HP Systems Management HomePage 2.1.7.168 HP System Management Homepage 2.1.5 HP System Management Homepage 2.1.4 HP System Management Homepage 2.1.3 .132 HP System Management Homepage 2.1.3 HP System Management Homepage 2.1.2 HP System Management Homepage 2.1.1 HP System Management Homepage 2.1 HP System Management Homepage 2.0.2 HP System Management Homepage 2.0.1 HP System Management Homepage 2.0 HP Secure Web Server for HP Tru64 UNIX 6.6.4 HP Internet Express 6.0 HP Internet Express 5.9 HP Internet Express 5.8 HP Internet Express 5.7 HP Internet Express 5.4 HP Internet Express 6.6 HP Internet Express 6.4 HP Internet Express 6.3 |
| Not Vulnerable: |
PHP PHP 5.2.1 PHP PHP 4.4.5 HP Systems Management HomePage 2.1.8 HP Internet Express 6.7 |
Discussion
PHP Str_Replace() Integer Overflow Vulnerability
PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a buffer-overflow and corrupt process memory.
Exploiting this issue may allow attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in a denial-of-service condition.
This issue affects versions prior to PHP 4.4.5 and 5.2.1.
PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a buffer-overflow and corrupt process memory.
Exploiting this issue may allow attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in a denial-of-service condition.
This issue affects versions prior to PHP 4.4.5 and 5.2.1.
Exploit / POC
PHP Str_Replace() Integer Overflow Vulnerability
The following proof of concept is available:
The following proof of concept is available:
Solution / Fix
PHP Str_Replace() Integer Overflow Vulnerability
Solution:
The vendor released PHP 4.4.5 and 5.2.1 to address this issue. Please see the references for more information.
HP Systems Management HomePage 2.1.7.168
PHP PHP 5.2
PHP PHP 4.4.4
HP Secure Web Server for HP Tru64 UNIX 6.6.4
Solution:
The vendor released PHP 4.4.5 and 5.2.1 to address this issue. Please see the references for more information.
HP Systems Management HomePage 2.1.7.168
-
HP HP System Management Homepage for Linux
http://h18023.www1.hp.com/support/files/server/us/download/26864.html -
HP HP System Management Homepage for Linux (AMD64/EM64T)
http://h18023.www1.hp.com/support/files/server/us/download/26866.html -
HP HP System Management Homepage for Windows
http://h18023.www1.hp.com/support/files/server/us/download/26977.html
PHP PHP 5.2
-
PHP PHP 5.2.1
http://www.php.net/downloads.php#v5
PHP PHP 4.4.4
-
PHP PHP 4.4.5
http://www.php.net/downloads.php#v4
HP Secure Web Server for HP Tru64 UNIX 6.6.4
-
HP sws_v6_6_5_kit.tar.gz
http://h30097.www3.hp.com/internet/download.htm#sws
References
PHP Str_Replace() Integer Overflow Vulnerability
References:
References: