Advisory: Multiple vulnerabilities within PHP 4/5
Release Date: 2004.12.15
Application: PHP4 <= 4.3.9 - PHP5 <= 5.0.2
Severity: Several vulnerabilities within PHP allow local and remote execution of arbitrary code
Vendor Status: Vendor has released bugfixed versions.
PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.
During the development of Hardened-PHP which adds security hardening features to the PHP codebase, several vulnerabilities within PHP were discovered that reach from bufferoverflows, over information leak vulnerabilities and path truncation vulnerabilities to safe_mode restriction bypass vulnerabilities.
[01 - pack() - integer overflow leading to heap bufferoverflow ]
Insufficient validation of the parameters passed to pack() can lead to a heap overflow which can be used to execute arbitrary code from within a PHP script. This enables an attacker to bypass safe_mode restrictions and execute arbitrary code with the permissions of the webserver. Due to the nature of this
function it is unlikely that a script accidently exposes it to remote attackers.
[02 - unpack() - integer overflow leading to heap info leak ]
Insufficient validation of the parameters passed to unpack() can lead to a heap information leak which can be used to retrieve secret data from the apache process. Additionally a skilled local attacker could use this vulnerability in combination with 01 to bypass heap canary protection systems. Similiar to 01 this function is usually not used on user supplied data within webapplications.
[03 - safe_mode_exec_dir bypass in multithreaded PHP ]
When safe_mode is activated within PHP, it is only allowed to execute commands within the configured safe_mode_exec_dir. Unfourtunately PHP does prepend a "cd [currentdir] ;" to any executed command when a PHP is running on a multithreaded unix webserver (f.e. some installations of Apache2). Because the name of the current directory is prepended directly a local attacker may bypass safe_mode_exec_dir restrictions by injecting shell- commands into the current directory name.
[04 - safe_mode bypass through path truncation ]
The safe_mode checks silently truncated the file path at MAXPATHLEN bytes before passing it to realpath(). In combination with certain malfunctional implementations of realpath() f.e. within glibc this
allows crafting a filepath that pass the safe_mode check although it points to a file that should fail the safe_mode check.
[05 - path truncation in realpath() ]
PHP uses realpath() within several places to get the real path of files. Unfourtunately some implementations of realpath() silently truncate overlong filenames (f.e. OpenBSD, and older NetBSD/FreeBSD) This can lead to arbitrary file include vulnerabilities if something like "include "modules/$userinput/config.inc.php"; is used on such systems.
[06 - unserialize() - wrong handling of negative references ]
The variable unserializer could be fooled with negative references to add false zvalues to hashtables. When those hashtables get destroyed this can lead to efree()s of arbitrary memory addresses which can result in arbitrary code execution. (Unless Hardened-PHP's memory manager canaries are activated).
[07 - unserialize() - wrong handling of references to freed data ]
Additionally to bug 06 the previous version of the variable unserializer allowed setting references to already freed entries in the variable hash. A skilled attacker can exploit this to create an universal string that will pass execution to an arbitrary memory address when it is passed to unserialize(). For AMD64 systems it was even possible to developed a string that directly passes execution to shellcode contained in the string itself.
It is necessary to understand that these strings can exploit a bunch of popular PHP applications remotely because they pass f.e. cookie content to unserialize().
Examples of vulnerable scripts:
- Invision Board
- Woltlab Burning Board 2.x
- Serendipity Weblog
Proof of Concept:
The Hardened-PHP project is not going to release exploits for any
of these vulnerabilities to the public.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1018 to issues 01, 02, the name CAN-2004-1019 to issues 06, 07, the name CAN-2004-1063 to issue 03 and the name CAN-2004-1064 to issues 04, 05.
It is strongly recommended to upgrade to the new PHP-Releases as soon as possible, because a lot of PHP applications expose the easy to exploit unserialize() vulnerability to remote attackers. Additionally we always recommend to run PHP with the Hardened-PHP patch applied.