PHP Mysqlnd Extension Information Disclosure and Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	40461
Class:	Boundary Condition Error
CVE:	CVE-2010-3062 CVE-2010-3063 CVE-2010-3064
Remote:	Yes
Local:	No
Published:	May 31 2010 12:00AM
Updated:	Oct 06 2010 03:30PM
Credit:	Stefan Esser
Vulnerable:	SuSE openSUSE 11.3 S.u.S.E. SUSE Linux Enterprise 11 SP1 S.u.S.E. SUSE Linux Enterprise 11 S.u.S.E. SUSE Linux Enterprise 10 SP3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3
Not Vulnerable:

PHP Mysqlnd Extension Information Disclosure and Multiple Buffer Overflow Vulnerabilities

The PHP Mysqlnd extension is prone to an information-disclosure vulnerability and multiple buffer-overflow vulnerabilities.

Successful exploits can allow attackers to obtain sensitive information or to execute arbitrary code in the context of applications using the vulnerable PHP functions. Failed attempts may lead to a denial-of-service condition.

PHP 5.3 through 5.3.2 are vulnerable.

PHP Mysqlnd Extension Information Disclosure and Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP Mysqlnd Extension Information Disclosure and Multiple Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

PHP Mysqlnd Extension Information Disclosure and Multiple Buffer Overflow Vulnerabilities

References:

• MOPS-2010-056: PHP php_mysqlnd_ok_read() Information Leak Vulnerability (Stefan Esser)
  
• MOPS-2010-057: PHP php_mysqlnd_rset_header_read() Buffer Overflow Vulnerability (Stefan Esser)
  
• MOPS-2010-058: PHP php_mysqlnd_read_error_from_line() Buffer Overflow Vulnerabil (Stefan Esser)
  
• MOPS-2010-059: PHP php_mysqlnd_auth_write() Stack Buffer Overflow Vulnerability (Stefan Esser)
  
• MySQL Native Driver Homepage (PHP)
  
• PHP Homepage (PHP)