PHP Post File Upload Buffer Overflow Vulnerabilities

BID:4183

Info

PHP Post File Upload Buffer Overflow Vulnerabilities

Bugtraq ID: 4183
Class: Boundary Condition Error
CVE:
Remote: Yes
Local: No
Published: Feb 26 2002 12:00AM
Updated: Feb 26 2002 12:00AM
Credit: This issue appears to have been discovered by Stefan Esser of E-Matters.
Vulnerable: PHP PHP 4.1.1
PHP PHP 4.1 .0
+ SuSE Linux 8.0 i386
 + SuSE Linux 8.0
PHP PHP 4.0.7 RC3
PHP PHP 4.0.7 RC2
PHP PHP 4.0.7 RC1
PHP PHP 4.0.7
PHP PHP 4.0.6
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ HP Secure OS software for Linux 1.0
- IBM AIX 4.3.3
- IBM AIX 4.3.2
- IBM AIX 4.3.1
- IBM AIX 4.3
- IBM AIX 5.1
 + MandrakeSoft Corporate Server 1.0.1
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 7.2
+ Mandriva Linux Mandrake 7.1
+ Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.2
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 alpha
 + Redhat Linux 7.1
+ Redhat Linux 7.0 i386
 + Redhat Linux 7.0 alpha
 + Redhat Linux 7.0
+ Sun Cobalt RaQ 550
+ Sun LX50
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.3
+ SuSE Linux 7.2 i386
 + SuSE Linux 7.2
+ Trustix Secure Linux 1.5
PHP PHP 4.0.5
PHP PHP 4.0.4
+ Compaq Compaq Secure Web Server PHP 1.0
+ Guardian Digital Engarde Secure Linux 1.0.1
+ SuSE Linux 7.2
+ SuSE Linux 7.1 x86
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1
+ SuSE Linux 7.0 sparc
 + SuSE Linux 7.0 ppc
 + SuSE Linux 7.0 i386
 + SuSE Linux 7.0 alpha
 + SuSE Linux 7.0
PHP PHP 4.0.3 pl1
+ SuSE Linux 6.4 ppc
 + SuSE Linux 6.4 i386
 + SuSE Linux 6.4 alpha
 + SuSE Linux 6.4
PHP PHP 4.0.3
+ Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 IA-32
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 + Debian Linux 2.2
+ Sun Cobalt Control Station 4100CS
+ Sun Cobalt Qube3 Japanese 4000WGJ
+ Sun Cobalt Qube3 Japanese w/ Caching and RAID 4100WGJ
+ Sun Cobalt Qube3 Japanese w/Caching 4010WGJ
+ Sun Cobalt RaQ XTR 3500R
+ Sun Cobalt RaQ XTR Japanese 3500R-ja
PHP PHP 4.0.2
PHP PHP 4.0.1 pl2
PHP PHP 4.0.1 pl1
PHP PHP 4.0.1
+ Sun Cobalt Qube3 4000WG
+ Sun Cobalt Qube3 w/ Caching and RAID 4100WG
+ Sun Cobalt Qube3 w/Caching 4010WG
+ Sun Cobalt RaQ4 3001R
+ Sun Cobalt RaQ4 Japanese RAID 3100R-ja
+ Sun Cobalt RaQ4 RAID 3100R
PHP PHP 3.0.18
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 IA-32
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 + Debian Linux 2.2
+ Redhat Linux 6.2 sparc
 + Redhat Linux 6.2 i386
 + Redhat Linux 6.2 alpha
 + Redhat Linux 6.2
 + Trustix Secure Linux 1.2
+ Trustix Secure Linux 1.1
PHP PHP 3.0.17
+ SuSE Linux 7.1 x86
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1
+ SuSE Linux 7.0 sparc
 + SuSE Linux 7.0 ppc
 + SuSE Linux 7.0 i386
 + SuSE Linux 7.0 alpha
 + SuSE Linux 7.0
+ Trustix Secure Linux 1.2
+ Trustix Secure Linux 1.1
PHP PHP 3.0.15
PHP PHP 3.0.14
PHP PHP 3.0 .16
+ SuSE Linux 6.4 ppc
 + SuSE Linux 6.4 i386
 + SuSE Linux 6.4 alpha
 + SuSE Linux 6.4
PHP PHP 3.0 .13
PHP PHP 3.0 .12
PHP PHP 3.0 .11
PHP PHP 3.0 .10
Kasenna MediaBase 4.0.1
- SGI IRIX 6.5.16 m
 - SGI IRIX 6.5.16 f
 - SGI IRIX 6.5.16
- SGI IRIX 6.5.15 m
 - SGI IRIX 6.5.15 f
 - SGI IRIX 6.5.15
- SGI IRIX 6.5.14 m
 - SGI IRIX 6.5.14 f
 - SGI IRIX 6.5.14
- SGI IRIX 6.5.13 m
 - SGI IRIX 6.5.13 f
 - SGI IRIX 6.5.13
- SGI IRIX 6.5.12 m
 - SGI IRIX 6.5.12 f
 - SGI IRIX 6.5.12
- SGI IRIX 6.5.11 m
 - SGI IRIX 6.5.11 f
 - SGI IRIX 6.5.11
- SGI IRIX 6.5.10 m
 - SGI IRIX 6.5.10 f
 - SGI IRIX 6.5.10
- SGI IRIX 6.5.9 m
 - SGI IRIX 6.5.9 f
 - SGI IRIX 6.5.9
- SGI IRIX 6.5.8 m
 - SGI IRIX 6.5.8 f
 - SGI IRIX 6.5.8
Not Vulnerable: PHP PHP 4.2 -dev
PHP PHP 4.1.2
+ Apple Mac OS X 10.1.5
+ Apple Mac OS X 10.1.4
+ Apple Mac OS X 10.1.3
+ Apple Mac OS X 10.1.2
+ Apple Mac OS X 10.1.1
+ Apple Mac OS X 10.1
+ Apple Mac OS X 10.1
+ Apple Mac OS X 10.0.4
+ Apple Mac OS X 10.0.3
+ Apple Mac OS X 10.0.2
+ Apple Mac OS X 10.0.1
+ Apple Mac OS X 10.0
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + MandrakeSoft Multi Network Firewall 2.0
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2

Discussion

PHP Post File Upload Buffer Overflow Vulnerabilities

PHP is a widely deployed scripting language, designed for web based development and CGI programming.

PHP does not perform proper bounds checking on in functions related to Form-based File Uploads in HTML (RFC1867). Specifically, this problem occurs in the functions which are used to decode MIME encoded files. As a result, it may be possible to overrun the buffer used for the vulnerable functions to cause arbitrary attacker-supplied instructions to be executed.

PHP is invoked through webservers remotely. It may be possible for remote attackers to execute this vulnerability to gain access to target systems. A vulnerable PHP interpreter module is available for Apache servers that is often enabled by default.

Exploit / POC

PHP Post File Upload Buffer Overflow Vulnerabilities

CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

An exploit for this vulnerability currently exists and is being used by attackers to actively exploit this vulnerability.

Solution / Fix

PHP Post File Upload Buffer Overflow Vulnerabilities

Solution:
The vendor has addressed this issue in PHP 4.1.2, affected users are advised to upgrade to the most recent version. In addition to upgrading to the most recent version of Apache.

PHP has created patches for the Post File Upload Buffer Overflow vulnerabilities. Users should apply the appropriate patch as follows:

For PHP 4.x (Apply patch in php-4.x.x/main)
For PHP 3.x (Apply patch in 3.0.x/functions)

Current versions of PHP and patches are available for download from:

http://www.php.net/downloads.php

This vulnerability does not affect PHP version 4.2.0-dev.

HP advises Secure OS 1.0 users to apply the available Red Hat fixes.

Conectiva has released an advisory (CLA-2002:545) which contains fixes for this issue. Please see the attached advisory for further details on obtaining fixes. The fixes released for Conectiva Linux 7.0 in advisory CLSA-2002:468 did not properly address this issue in the PHP3 packages. The new advisory contains the correct PHP3 packages for Conectiva Linux 7.0.

It has been reported that Kasenna has released fixes to address this issue, identified in support issues 1095 and 1330.

SGI has identified vulnerable optional Kasenna software. More information is available in SGI advisory 20030502-01-I.

Fixes are available:


PHP PHP 3.0 .13

PHP PHP 3.0 .11

PHP PHP 3.0 .10

PHP PHP 3.0 .12

PHP PHP 3.0 .16

PHP PHP 3.0.14

PHP PHP 3.0.15

PHP PHP 3.0.17

PHP PHP 3.0.18

PHP PHP 4.0.1

PHP PHP 4.0.1 pl2

PHP PHP 4.0.1 pl1

PHP PHP 4.0.2

PHP PHP 4.0.3 pl1

PHP PHP 4.0.3

PHP PHP 4.0.4

PHP PHP 4.0.5

PHP PHP 4.0.6

PHP PHP 4.0.7 RC2

PHP PHP 4.0.7 RC1

PHP PHP 4.0.7 RC3

PHP PHP 4.0.7

PHP PHP 4.1 .0

PHP PHP 4.1.1

References

PHP Post File Upload Buffer Overflow Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report