sebug-appdir:php
Release time: 2007-03-17
Impact Version:
PHP php 5.2.1
PHP php 5.1.6
PHP php 5.1.5
PHP php 5.1.4
PHP php 5.1.3
PHP php 5.1.3
PHP php 5.1.2
PHP php 5.1.1
PHP PHP 5.1
PHP php 5.0.5
PHP php 5.0.4
PHP php 5.0.3
+ Trustix Secure Linux 2.2
PHP php 5.0.2
PHP php 5.0.1
PHP PHP 5.0 Candidate 3
PHP PHP 5.0 candidate 2
PHP PHP 5.0 Candidate 1
PHP PHP 5.0.0
PHP PHP 5.2
Vulnerability Description:
PHP is a widely used web development scripting language.
The PHP session_regenerate_id function has a dual-release content breach problem that can be exploited by a remote attacker to perform a denial-of-service attack on an application and may cause arbitrary instructions to execute.
The session_regenerate_id () function releases the old session recognizer first, and then immediately assigns a new value generated by the session recognition Builder:
Copy Code code as follows:
Php_function (session_regenerate_id)
{
...
if (PS (ID)) {
...
Efree (PS (id));
}
PS (id) = PS (mod)->s_create_sid (&ps (mod_data), NULL tsrmls_cc);
PS (Send_cookie) = 1;
PHP_SESSION_RESET_ID (Tsrmls_c);
Return_true;
}
Return_false;
}
However, this allocation operation is not an atomic operation. As a result, it can be interrupted as a memory limit violation and, depending on the PHP configuration, the generator can trigger a PHP error or cause an interruption.
Copy Code code as follows:
Phpapi Char *php_session_create_id (Ps_create_sid_args)
{
...
Switch (PS (hash_func)) {
...
Default
Php_error_docref (NULL tsrmls_cc, E_error, "Invalid session hash function");
Efree (BUF);
return NULL;
}
...
if (PS (Hash_bits_per_character) < 4
|| PS (Hash_bits_per_character) > 6) {
PS (Hash_bits_per_character) = 4;
Php_error_docref (NULL tsrmls_cc, e_warning, "The INI setting hash_bits_per_character ...");
}
...
This problem can be easily exploited by registering a malicious user space error processor. When this processor invokes a hash table assigned to the same place as the previous session recognizer, then the malicious error handler can invoke the session_id () function and the allocation contains a forged hash table to the same place as the hash table, thus triggering another release of the session recognizer. When the user incorrectly completes the processor, it will deconstruct the overwritten hash table and invoke the attacker's provided code.
Http://www.php-security.org/MOPB/MOPB-22-2007.html
Test method:
[Www.sebug.net]
This site provides programs (methods) may be offensive, only for security research and teaching use, the risk of conceit!
http://www.php-security.org/MOPB/code/MOPB-22-2007.php
Sebug Security Recommendations:
There are no solutions available:
