PHP GD Extension 'imagepstext()' Function Stack Buffer Overflow Vulnerability

Bugtraq ID:	45338
Class:	Boundary Condition Error
CVE:	CVE-2010-4698
Remote:	Yes
Local:	No
Published:	Dec 10 2010 12:00AM
Updated:	Jul 02 2012 11:40AM
Credit:	Martin Barbella
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Turbolinux Client 2008 Turbolinux Appliance Server 3.0 x64 Turbolinux Appliance Server 3.0 SuSE SUSE Linux Enterprise 11 SP1 SuSE SUSE Linux Enterprise 10 SP4 SuSE SUSE Linux Enterprise 10 SP3 SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.3.3 Pardus Linux 2009 0 HP OpenVMS Secure Web Server 7.3 -2 HP OpenVMS Secure Web Server 7.3 -1 HP OpenVMS Secure Web Server 7.3 HP OpenVMS Secure Web Server 7.2 -2 HP OpenVMS Secure Web Server 1.2 HP OpenVMS Secure Web Server 1.1 -1 HP OpenVMS Secure Web Server 2.2 HP OpenVMS Secure Web Server 2.1-1
Not Vulnerable:	PHP PHP 5.3.4

PHP GD Extension 'imagepstext()' Function Stack Buffer Overflow Vulnerability

PHP is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary-checks on user-supplied input..

An attacker can exploit this issue to execute arbitrary machine code in the context of the PHP process. Failed exploit attempts will likely crash the webserver, denying service to legitimate users.

PHP 5.3.3 is vulnerable; other versions may also be affected.

PHP GD Extension 'imagepstext()' Function Stack Buffer Overflow Vulnerability

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/45338.php

PHP GD Extension 'imagepstext()' Function Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

PHP GD Extension 'imagepstext()' Function Stack Buffer Overflow Vulnerability

References:

• PHP Homepage (PHP Group)
  
• PHP 5.3.3 GD extension imagepstext stack buffer overflow (Martin Barbella)