Home page logo

fulldisclosure logo Full Disclosure mailing list archives

PHP Exploit
From: full-disclosure () lists netsys com (Charles 'core' Stevenson)
Date: Mon, 22 Jul 2002 14:06:27 -0600

Where's the exploit?



Paul Tinsley wrote:
Sorry if this was already posted but, this is a serious vulnerability given
the wide spread use of PHP, and the plenty of people that have it on by
default that don't actually use it.

For those that are familiar with http://www.apachetoolbox.com, a build tool
for apache, It was patched at 8:46 this morning:

v1.5.59               07/22/02
              PDFLib patch sent in by Dominique Massonie. Updated PHP
              to v4.2.2.

Venerability Text from PHP site:


Issued on:    July 22, 2002 
Software:    PHP versions 4.2.0 and 4.2.1 
Platforms:    All 

The PHP Group has learned of a serious security vulnerability in PHP
versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code
with the privileges of the web server. This vulnerability may be exploited
to compromise the web server and, under certain conditions, to gain
privileged access.

PHP contains code for intelligently parsing the headers of HTTP POST
requests. The code is used to differentiate between variables and files sent
by the user agent in a "multipart/form-data" request. This parser has
insufficient input checking, leading to the vulnerability.

The vulnerability is exploitable by anyone who can send HTTP POST requests
to an affected web server. Both local and remote users, even from behind
firewalls, may be able to gain privileged access.

Both local and remote users may exploit this vulnerability to compromise the
web server and, under certain conditions, to gain privileged access. So far
only the IA32 platform has been verified to be safe from the execution of
arbitrary code. The vulnerability can still be used on IA32 to crash PHP
and, in most cases, the web server.

The PHP Group has released a new PHP version, 4.2.2, which incorporates a
fix for the vulnerability. All users of affected PHP versions are encouraged
to upgrade to this latest version. The downloads web site at 

has the new 4.2.2 source tarballs, Windows binaries and source patches from
4.2.0 and 4.2.1 available for download.

If the PHP applications on an affected web server do not rely on HTTP POST
input from user agents, it is often possible to deny POST requests on the
web server.

In the Apache web server, for example, this is possible with the following
code included in the main configuration file or a top-level .htaccess file: 

<Limit POST>
   Order deny,allow
   Deny from all

Note that an existing configuration and/or .htaccess file may have
parameters contradicting the example given above.

The PHP Group would like to thank Stefan Esser of e-matters GmbH for
discovering this vulnerability. e-matters GmbH has also released an
independent advisory, describing the vulnerability in more detail.

Paul Tinsley
paul.tinsley () phyve com
Full-Disclosure - We believe in it.
Full-Disclosure () lists netsys com

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]