PHP openlog() Buffer Overflow Vulnerability
BID:7210
Info
PHP openlog() Buffer Overflow Vulnerability
| Bugtraq ID: | 7210 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2003-0172 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 27 2003 12:00AM |
| Updated: | Jul 11 2009 09:06PM |
| Credit: | The discovery of this vulnerability has been credited to <[email protected]>. |
| Vulnerable: |
PHP PHP 5.0 candidate 1 PHP PHP 4.3.7 PHP PHP 4.3.5 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 |
| Not Vulnerable: | |
Discussion
PHP openlog() Buffer Overflow Vulnerability
A buffer overflow has been reported in the PHP openlog() function. By passing an argument of excessive size to the function, it may be possible for an attacker to overwrite memory, resulting in a denial of service. It is also possible for an attacker to execute arbitrary code in the PHP interpreter.
This vulnerability was reported for PHP 4.3.1 and later, however it is likely that previous versions are also affected. This issue appears to affect all platforms PHP runs on.
A buffer overflow has been reported in the PHP openlog() function. By passing an argument of excessive size to the function, it may be possible for an attacker to overwrite memory, resulting in a denial of service. It is also possible for an attacker to execute arbitrary code in the PHP interpreter.
This vulnerability was reported for PHP 4.3.1 and later, however it is likely that previous versions are also affected. This issue appears to affect all platforms PHP runs on.
Exploit / POC
PHP openlog() Buffer Overflow Vulnerability
The following proof of concept code has been released:
<?php
openlog(str_repeat("X", 1500), LOG_PID, LOG_DAEMON);
?>
The following exploit is reported to exploit this vulnerability remotely. It should be noted that the integrity of this exploit has not been verified by Symantec.
The following proof of concept code has been released:
<?php
openlog(str_repeat("X", 1500), LOG_PID, LOG_DAEMON);
?>
The following exploit is reported to exploit this vulnerability remotely. It should be noted that the integrity of this exploit has not been verified by Symantec.
Solution / Fix
PHP openlog() Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PHP openlog() Buffer Overflow Vulnerability
References:
References:
- PHP Homepage (PHP Group)
- @(#)Mordred Labs advisory - PHP for Win32: buffer overflow in openlog() function (
- PHP v4.3.x exploit for Windows. ("The Warlock"
- Re: @(#)Mordred Labs advisory - PHP for Win32: buffer overflow in openlog() ("Jason Brooke"