LT   EN   RU  
2024 г. март 29 д., пятница Straipsniai.lt - Информационный портал
  
  Компьютеры > Компьютерные технологии > Хакеры
Lankomumo reitingas Версия для печати Версия для печати
Multiple vulnerabilities within PHP <= 4.3.9, PHP5 <= 5.0.2
Advisory: Multiple vulnerabilities within PHP 4/5
Release Date: 2004.12.15

Application: PHP4 <= 4.3.9 - PHP5 <= 5.0.2
Severity: Several vulnerabilities within PHP allow local and remote execution of arbitrary code
Risk: Critical
Vendor Status: Vendor has released bugfixed versions.

Overview:

PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML.

During the development of Hardened-PHP which adds security hardening features to the PHP codebase, several vulnerabilities within PHP were discovered that reach from bufferoverflows, over information leak vulnerabilities and path truncation vulnerabilities to safe_mode restriction bypass vulnerabilities.

Details:

[01 - pack() - integer overflow leading to heap bufferoverflow ]

Insufficient validation of the parameters passed to pack() can lead to a heap overflow which can be used to execute arbitrary code from within a PHP script. This enables an attacker to bypass safe_mode restrictions and execute arbitrary code with the permissions of the webserver. Due to the nature of this
function it is unlikely that a script accidently exposes it to remote attackers.

[02 - unpack() - integer overflow leading to heap info leak ]

Insufficient validation of the parameters passed to unpack() can lead to a heap information leak which can be used to retrieve secret data from the apache process. Additionally a skilled local attacker could use this vulnerability in combination with 01 to bypass heap canary protection systems. Similiar to 01 this function is usually not used on user supplied data within webapplications.

[03 - safe_mode_exec_dir bypass in multithreaded PHP ]

When safe_mode is activated within PHP, it is only allowed to execute commands within the configured safe_mode_exec_dir. Unfourtunately PHP does prepend a "cd [currentdir] ;" to any executed command when a PHP is running on a multithreaded unix webserver (f.e. some installations of Apache2). Because the name of the current directory is prepended directly a local attacker may bypass safe_mode_exec_dir restrictions by injecting shell- commands into the current directory name.

[04 - safe_mode bypass through path truncation ]

The safe_mode checks silently truncated the file path at MAXPATHLEN bytes before passing it to realpath(). In combination with certain malfunctional implementations of realpath() f.e. within glibc this
allows crafting a filepath that pass the safe_mode check although it points to a file that should fail the safe_mode check.

[05 - path truncation in realpath() ]

PHP uses realpath() within several places to get the real path of files. Unfourtunately some implementations of realpath() silently truncate overlong filenames (f.e. OpenBSD, and older NetBSD/FreeBSD) This can lead to arbitrary file include vulnerabilities if something like "include "modules/$userinput/config.inc.php"; is used on such systems.

[06 - unserialize() - wrong handling of negative references ]

The variable unserializer could be fooled with negative references to add false zvalues to hashtables. When those hashtables get destroyed this can lead to efree()s of arbitrary memory addresses which can result in arbitrary code execution. (Unless Hardened-PHP's memory manager canaries are activated).

[07 - unserialize() - wrong handling of references to freed data ]

Additionally to bug 06 the previous version of the variable unserializer allowed setting references to already freed entries in the variable hash. A skilled attacker can exploit this to create an universal string that will pass execution to an arbitrary memory address when it is passed to unserialize(). For AMD64 systems it was even possible to developed a string that directly passes execution to shellcode contained in the string itself.

It is necessary to understand that these strings can exploit a bunch of popular PHP applications remotely because they pass f.e. cookie content to unserialize().

Examples of vulnerable scripts:

- phpBB2
- Invision Board
- vBulletin
- Woltlab Burning Board 2.x
- Serendipity Weblog
- phpAds(New)
- etc.

Proof of Concept:

The Hardened-PHP project is not going to release exploits for any
of these vulnerabilities to the public.

CVE Information:

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1018 to issues 01, 02, the name CAN-2004-1019 to issues 06, 07, the name CAN-2004-1063 to issue 03 and the name CAN-2004-1064 to issues 04, 05.

Recommendation:

It is strongly recommended to upgrade to the new PHP-Releases as soon as possible, because a lot of PHP applications expose the easy to exploit unserialize() vulnerability to remote attackers. Additionally we always recommend to run PHP with the Hardened-PHP patch applied.

         

Lankomumo reitingas

Oбсудить на форуме - Oбсудить на форуме

Версия для печати - Версия для печати

Назад
Случайные теги:    Страны (22)    Открытый код (2)    Дельфины (4)    Любовь (32)    Шахматы (2)    Технологий (4)    НЛО (24)    Медицина (84)    Спортивная гимнастика (4)    Компьютерные игры (26)    Аквариумы (10)    Кино (45)    Скейборды (2)    Анна Ахматова (3)    Общение (322)    Биология (34)    Наркопсихотерапия (2)    Математика (2)    Настольные игры (17)    Фехтирования (6)    Сканеры (2)    Культура (88)    Физкультура (3)    Кормление грудью (5)    Гостья из будущего (35)    Помощ и превенция (2)    Армения (10)    Мама и ребенок (19)    Операционные системы (8)    Животные (31)    Драконы (12)    Архитектура (3)    Садоводство (12)    Бизнес и финансы (20)    Педагогика (10)    Воспитания (3)    Фэншуй (4)    Право человека (8)    Сертификаты SSL (10)    Сельское хозяйство (19)    Алкохольные напитки (29)    Здоровье (86)    Генетика (10)    Экология (18)    Кошки (11)    Собаки (6)    Еврейи (10)    Фильмы (10)    Путешествия (2)    Кормление (4)
1. Марокканские хакеры воюют с Израилем
2. Банкам предложена система защиты от онлайн-грабежей
3. Турецкие хакеры взломали французский сайт Microsoft
4. Шотландский университет начинает готовить дипломированных хакеров
5. Microsoft выпускает защитные программы под новым брендом
6. Венесуэлец украл телефонного трафика на 1 млн долларов
7. Швеция расследует атаку на правительственный сайт
8. Российский бэкдор распространяется через сайт американской торговой сети
9. Microsoft рекомендует использовать Word в безопасном режиме
10. В университете Огайо в течение года не замечали взлома сервера
1. Wi-Fi побеждает Ethernet в домашних сетях
2. Foundstone выпустила SiteDigger - программу для поиска уязвимостей на сайтах
3. iWork против Microsoft Office
4. Обход каталога в phpBB Attachment Mod
5. Новый хакерский инструмент: шоколадка
6. Билл Гейтс и другие коммунисты
7. Toshiba вводит в практику квантовую криптографию
8. Кто сказал, что безопасность должна оставаться несбыточной мечтой?
9. Корпорации беззащитны перед внутренними угрозами
10. P2P-пираты - полезные члены сообщества
Map