PHP 'unserialize()' Function Information Disclosure and Remote Code Execution Vulnerabilities
BID:74413
Info
PHP 'unserialize()' Function Information Disclosure and Remote Code Execution Vulnerabilities
| Bugtraq ID: | 74413 |
| Class: | Unknown |
| CVE: |
CVE-2015-4600 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 29 2015 12:00AM |
| Updated: | Jul 05 2016 10:04PM |
| Credit: | Taoguang Chen |
| Vulnerable: |
Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 PHP PHP 5.4.3 PHP PHP 5.4.2 PHP PHP 5.4.1 PHP PHP 5.5.0-DEV PHP PHP 5.4.0beta2 |
| Not Vulnerable: | |
Discussion
PHP 'unserialize()' Function Information Disclosure and Remote Code Execution Vulnerabilities
PHP is prone to an information-disclosure vulnerability and a heap-based buffer overflow vulnerability.
Attackers can exploit this issue to gain access to sensitive information, or execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause a denial-of-service condition.
PHP is prone to an information-disclosure vulnerability and a heap-based buffer overflow vulnerability.
Attackers can exploit this issue to gain access to sensitive information, or execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause a denial-of-service condition.
Exploit / POC
PHP 'unserialize()' Function Information Disclosure and Remote Code Execution Vulnerabilities
The following proof-of-concept is available:
The following proof-of-concept is available:
References
PHP 'unserialize()' Function Information Disclosure and Remote Code Execution Vulnerabilities
References:
References:
- PHP Homepage (PHP)