PHP array_pad() Integer Overflow Memory Corruption Vulnerability
BID:7256
Info
PHP array_pad() Integer Overflow Memory Corruption Vulnerability
| Bugtraq ID: | 7256 |
| Class: | Unknown |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 02 2003 12:00AM |
| Updated: | Apr 02 2003 12:00AM |
| Credit: | Discovery of this vulnerability credited to Sir Mordred <[email protected]>. |
| Vulnerable: |
PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 |
| Not Vulnerable: | |
Discussion
PHP array_pad() Integer Overflow Memory Corruption Vulnerability
A vulnerability has been reported in PHP. The problem occurs in the array_pad() function and may allow an attacker to corrupt memory.
The affected function reportedly fails to ensure that proper boundary checks are performed on values supplied by a malicious user. This may result in an integer overflow when array_pad() is called with an overly long value for its second argument.
Further details of this vulnerability are currently unknown. This BID will be updated as more information becomes available.
A vulnerability has been reported in PHP. The problem occurs in the array_pad() function and may allow an attacker to corrupt memory.
The affected function reportedly fails to ensure that proper boundary checks are performed on values supplied by a malicious user. This may result in an integer overflow when array_pad() is called with an overly long value for its second argument.
Further details of this vulnerability are currently unknown. This BID will be updated as more information becomes available.
Exploit / POC
PHP array_pad() Integer Overflow Memory Corruption Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
PHP array_pad() Integer Overflow Memory Corruption Vulnerability
Solution:
Gentoo Linux has corrected this vulnerability in their PHP/mod_php packages. Users are advised to run the following commands:
emerge sync
emerge mod_php
and/or
emerge php
emerge clean
Currently we are not aware of any other vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Gentoo Linux has corrected this vulnerability in their PHP/mod_php packages. Users are advised to run the following commands:
emerge sync
emerge mod_php
and/or
emerge php
emerge clean
Currently we are not aware of any other vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PHP array_pad() Integer Overflow Memory Corruption Vulnerability
References:
References:
- PHP Homepage (PHP Group)