what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Open Source CERT Security Advisory 2009.17

Open Source CERT Security Advisory 2009.17
Posted Dec 1, 2009
Authored by Andrea Barisani, Open Source CERT | Site ocert.org

PHP versions prior to 5.3.1 suffer from from several bugs that may pose a security risk. Issues such as buffer overflows, arbitrary memory reads, and more have been addressed.

tags | advisory, overflow, arbitrary, php
SHA-256 | c307d37e34d7297809aa54256b01c4c1dc7a04599f485122ab50a3cb3b7c3401

Open Source CERT Security Advisory 2009.17

Change Mirror Download

#2009-017 PHP multiple issues

Description:

PHP, an open source scripting language, suffers from several bugs that may
pose a security risk.

The reported issues have been discovered in several API functions, issues
include buffer overflows, near null reads/writes, arbitrary memory read
and an off-by-one issue. Some of the issues have been previously reported
in older versions of PHP but they either have not been fixed or they were
re-introduced in a later time. The issues have been discovered in both
core and, in some cases, PECL functions/classes/methods.

The following methods have been fixed.

ibase_pconnect
ibase_connect
com_print_typeinfo
popen
mssql_connect
mssql_pconnect
SplFileObject
DOMImplementation->createDocumentType
documentation()->public_id
SDO_DAS_ChangeSummary->beginLogging
SDO_DAS_Setting->getPropertyIndex
SDO_SequenceImpl->getProperty

The following methods have been removed in PHP 5.3, they are still
available without fixes in 5.2.11.

msql_close
msql_connect
msql_pconnect
msql_select_db
msql_list_tables

Affected version:

PHP < 5.3.1

Fixed version:

PHP >= 5.3.1

Credit: vulnerability report received from Emmanouel Kellinis, KPMG London.

CVE: N/A

Timeline:

2009-07-10: vulnerability report received
2009-07-15: contacted PHP security team
2009-07-15: vendor provides initial feedback, classifies the security
impact as low
2009-08-09: oCERT asks for feedback about the timescale for eventual fixes
2009-08-24: vendor replies that most issues will not be fixed as they are
present in deprecated extensions or are not understood
2009-08-25: reporter offers to clarify all the issues and provides test
cases
2009-08-26: after reporter feedback vendor commits more fixes
2009-10-05: reporter asks clarification about fixed/pending bugs
2009-10-27: after further reporter feedback vendor commits more fixes
2009-11-30: advisory published

References:
http://svn.php.net/viewvc?view=revision&revision=289996
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/interbase/interbase.c?r1=272370&r284159
http://svn.php.net/viewvc?view=revision&revision=287779
http://svn.php.net/viewvc/php/php-src/trunk/TSRM/tsrm_win32.c?r1=287673&r2=287779
http://www.php.net/ChangeLog-5.php#5.3.1

Permalink:
http://www.ocert.org/advisories/ocert-2009-017.html

--
Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team

<lcars@ocert.org> http://www.ocert.org
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close