PHP PHAR 'phar_parse_tarfile()' Function Remote Memory Corruption Vulnerability
BID:74700
Info
PHP PHAR 'phar_parse_tarfile()' Function Remote Memory Corruption Vulnerability
| Bugtraq ID: | 74700 |
| Class: | Unknown |
| CVE: |
CVE-2015-4021 |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2015 12:00AM |
| Updated: | Jul 21 2017 01:07PM |
| Credit: | Emmanuel Law |
| Vulnerable: |
Ubuntu Ubuntu Linux 15.04 Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Slackware Slackware Linux 14.1 Slackware Linux x86_64 -current Slackware Linux 14.1 x86_64 Slackware Linux 14.0 x86_64 Slackware Linux 14.0 Slackware Linux -current Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 7 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 7 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 7 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 7 PHP PHP 5.6.5 PHP PHP 5.6.4 PHP PHP 5.6.1 PHP PHP 5.5.21 PHP PHP 5.5.14 PHP PHP 5.5.13 PHP PHP 5.5.12 PHP PHP 5.5.11 PHP PHP 5.5.10 PHP PHP 5.5.6 PHP PHP 5.5.5 PHP PHP 5.5.4 PHP PHP 5.5.3 PHP PHP 5.5.1 PHP PHP 5.5 PHP PHP 5.4.37 PHP PHP 5.4.30 PHP PHP 5.4.29 PHP PHP 5.4.26 PHP PHP 5.4.25 PHP PHP 5.4.17 PHP PHP 5.4.14 PHP PHP 5.4.8 PHP PHP 5.4.7 PHP PHP 5.4.6 PHP PHP 5.4.4 PHP PHP 5.4.3 PHP PHP 5.4.2 PHP PHP 5.4.1 PHP PHP 5.6.8 PHP PHP 5.6.7 PHP PHP 5.6.6 PHP PHP 5.6.3 PHP PHP 5.6.2 PHP PHP 5.6 PHP PHP 5.5.9 PHP PHP 5.5.8 PHP PHP 5.5.7 PHP PHP 5.5.24 PHP PHP 5.5.23 PHP PHP 5.5.22 PHP PHP 5.5.20 PHP PHP 5.5.2 PHP PHP 5.5.19 PHP PHP 5.5.18 PHP PHP 5.5.17 PHP PHP 5.5.16 PHP PHP 5.5.15 PHP PHP 5.4.9 PHP PHP 5.4.5 PHP PHP 5.4.40 PHP PHP 5.4.39 PHP PHP 5.4.38 PHP PHP 5.4.36 PHP PHP 5.4.35 PHP PHP 5.4.34 PHP PHP 5.4.33 PHP PHP 5.4.32 PHP PHP 5.4.31 PHP PHP 5.4.28 PHP PHP 5.4.27 PHP PHP 5.4.24 PHP PHP 5.4.23 PHP PHP 5.4.22 PHP PHP 5.4.21 PHP PHP 5.4.20 PHP PHP 5.4.19 PHP PHP 5.4.18 PHP PHP 5.4.16 PHP PHP 5.4.15 PHP PHP 5.4.13 PHP PHP 5.4.12 PHP PHP 5.4.11 PHP PHP 5.4.10 Oracle Solaris 11.3 Oracle Linux 7 Oracle Linux 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 Apple Mac OS X 10.9.5 Apple Mac Os X 10.10.4 Apple Mac Os X 10.10.3 Apple Mac OS X 10.10.2 Apple Mac OS X 10.10.1 Apple Mac OS X 10.10 AlienVault AlienVault 5.0.4 AlienVault AlienVault 5.1 AlienVault AlienVault 5.0 AlienVault AlienVault 4.15.2 AlienVault AlienVault 4.15.1 AlienVault AlienVault 4.15 AlienVault AlienVault 4.14 AlienVault AlienVault 4.13 AlienVault AlienVault 4.12.1 AlienVault AlienVault 4.12 |
| Not Vulnerable: |
PHP PHP 5.6.9 PHP PHP 5.5.25 PHP PHP 5.4.41 Apple Mac Os X 10.10.5 AlienVault AlienVault 5.2 |
Discussion
PHP PHAR 'phar_parse_tarfile()' Function Remote Memory Corruption Vulnerability
PHP is prone to a remote memory-corruption vulnerability.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.
PHP is prone to a remote memory-corruption vulnerability.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.
Exploit / POC
PHP PHAR 'phar_parse_tarfile()' Function Remote Memory Corruption Vulnerability
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
Solution / Fix
PHP PHAR 'phar_parse_tarfile()' Function Remote Memory Corruption Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Slackware Linux -current
Slackware Linux 14.1 x86_64
Slackware Linux x86_64 -current
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Slackware Linux -current
-
Slackware php-5.6.9-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/ph p-5.6.9-i586-1.txz
Slackware Linux 14.1 x86_64
-
Slackware php-5.4.41-x86_64-1_slack14.1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/package s/php-5.4.41-x86_64-1_slack14.1.txz
Slackware Linux x86_64 -current
-
Slackware php-5.6.9-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ n/php-5.6.9-x86_64-1.txz
References
PHP PHAR 'phar_parse_tarfile()' Function Remote Memory Corruption Vulnerability
References:
References:
- Fix bug #69453 - don't try to cut empty string (PHP)
- PHP 5 ChangeLog (PHP)
- PHP Homepage (PHP)
- #69453 Memory Corruption in phar_parse_tarfile when entry filename starts with (PHP)
- APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006 (Apple)
- Fix bug #69453 - don't try to cut empty string (PHP)
- Oracle Linux Bulletin - January 2016 (Oracle)
- Security Advisory - AlienVault v5.2 addresses 55 vulnerabilities (AlienVault)
- Security Advisory Important: php security and bug fix update (Redhat)