PHP Zend Engine (CVE-2010-4697) Use-after-free Heap Corruption Vulnerability

Bugtraq ID:	45952
Class:	Boundary Condition Error
CVE:	CVE-2010-4697
Remote:	Yes
Local:	No
Published:	Dec 08 2010 12:00AM
Updated:	Mar 19 2015 08:12AM
Credit:	mail_ben_schmidt
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Turbolinux Client 2008 Turbolinux Appliance Server 3.0 x64 Turbolinux Appliance Server 3.0 SuSE SUSE Linux Enterprise 11 SP1 SuSE SUSE Linux Enterprise 10 SP4 SuSE SUSE Linux Enterprise 10 SP3 SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.2.13 PHP PHP 5.2.12 PHP PHP 5.2.11 PHP PHP 5.2.10 PHP PHP 5.2.9 PHP PHP 5.2.8 PHP PHP 5.2.7 PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4 PHP PHP 5.2.3 PHP PHP 5.3.3 PHP PHP 5.2.14 Pardus Linux 2009 0 HP OpenVMS Secure Web Server 7.3 -2 HP OpenVMS Secure Web Server 7.3 -1 HP OpenVMS Secure Web Server 7.3 HP OpenVMS Secure Web Server 7.2 -2 HP OpenVMS Secure Web Server 1.2 HP OpenVMS Secure Web Server 1.1 -1 HP OpenVMS Secure Web Server 2.2 HP OpenVMS Secure Web Server 2.1-1 F5 FirePass 6.0.3 F5 FirePass 6.0.2 F5 FirePass 6.0.1 F5 FirePass 7.0 F5 FirePass 6.1 F5 FirePass 6.0.2.3 F5 FirePass 6.0 F5 BigIP Local Traffic Manager (LTM) 8900 10.2.1 HFA3 F5 BigIP Local Traffic Manager (LTM) 6400 10.2.1 HFA3 F5 BigIP Link Controller 10.1 F5 BigIP Link Controller 10.0.1 F5 BigIP Link Controller 10.0 F5 BigIP Global Traffic Manager (GTM) 10.1 F5 BigIP Global Traffic Manager (GTM) 10.0.1 F5 BigIP Global Traffic Manager (GTM) 10.0 F5 BigIP Application Security Manager (ASM) 10.1 F5 BigIP Application Security Manager (ASM) 10.0.1 F5 BigIP Application Security Manager (ASM) 10.0 F5 BIG-IP Protocol Security Manager 10.1 F5 BIG-IP Protocol Security Manager 10.0
Not Vulnerable:	PHP PHP 5.2.15 PHP PHP 5.3.4

PHP Zend Engine (CVE-2010-4697) Use-after-free Heap Corruption Vulnerability

PHP is prone to a remote heap-corruption vulnerability.

Successful attacks will cause applications written in PHP to hang, creating a denial-of-service condition.

Due to the nature of this issue, it may be possible to leverage this vulnerability to execute arbitrary code, but this has not been confirmed.

Versions prior to PHP 5.2.15 and 5.3.4 are vulnerable.

PHP Zend Engine (CVE-2010-4697) Use-after-free Heap Corruption Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

PHP Zend Engine (CVE-2010-4697) Use-after-free Heap Corruption Vulnerability

Solution:
Updates are available. Please see the references for more information.

PHP Zend Engine (CVE-2010-4697) Use-after-free Heap Corruption Vulnerability

References:

• Bug #52879 Objects unreferenced in __get, __set, __isset or __unset can be free (PHP)
  
• PHP Changelog (PHP)
  
• PHP Homepage (PHP Group)
  
• sol13519: Multiple PHP vulnerabilities (F5 Networks)