PHP ibase_gen_id () function single-byte overflow vulnerability

PHP ibase_gen_id () function single-byte overflow vulnerability

Release date: 2010-08-18
Updated on: 2010-08-19

Affected Systems:
PHP 5.3.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 42516

PHP is a widely used scripting language. It is especially suitable for Web development and can be embedded into HTML.

The ibase_gen_id () function of PHP copies the generator variable provided by the user to the buffer of the 128-byte query variable size, which may trigger a single-byte overflow. [1] is the snprintf copy statement for the query variable.

/* {Proto int ibase_gen_id (string generator [, int increment [,

Resource link_identifier])

Increments the named generator and returns its new value */

PHP_FUNCTION (ibase_gen_id)

{

Zval * link = NULL;

Char query [128], * generator;

Int gen_len;

Long inc = 1;

Ibase_db_link * ib_link;

Ibase_trans * trans = NULL;

XSQLDA out_sqlda;

ISC_INT64 result;

RESET_ERRMSG;

If (FAILURE = zend_parse_parameters (ZEND_NUM_ARGS () TSRMLS_CC,

"S | lr", & generator, & gen_len,

& Inc, & link )){

RETURN_FALSE;

}

PHP_IBASE_LINK_TRANS (link, ib_link, trans );

[1] snprintf (query, sizeof (query), "SELECT GEN_ID (% s, % ld) FROM

Rdb $ database ", generator, inc );

...

}

<* Source: Canberk BOLAT

Link: http://www.exploit-db.com/exploits/14678/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Http://www.exploit-db.com/sploits/ibase_gen_id_poc.zip

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:

If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:

* Replace [1] with [2]

--- [1] snprintf (query, sizeof (query), "SELECT GEN_ID (% s, % ld) FROM

Rdb $ database ", generator, inc );

++ [2] snprintf (query, sizeof (query)-1 "SELECT GEN_ID (% s, % ld)

FROM rdb $ database ", generator, inc );

Vendor patch:

PHP
---
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.php.net