PHP Remote Compromise/DOS Vulnerability [LWN.net]

Package(s):

mod_php4

CVE #(s):

Created:

July 22, 2002

Updated:

February 18, 2003

Description:

PHP 4.2.0 and 4.2.1 have an error in the handling of POST requests which can lead to the corruption of memory, and the usual bad consequences. According to this alert, the vulnerability can only be used for denial of service on x86 systems - there is no way to get it to run exploit code. SPARC/Solaris systems are apparently vulnerable to full remote compromise.

According to the CERT Advisory, almost every Linux distributor, it seems, ships older (and thus not vulnerable) versions of PHP.

Note that, sometimes, systems thought to be safe from remote compromise turn out to be vulnerable to a modified attack, so x86 users should not relax too much. The solution, for those systems with PHP 4.2.0 or 4.2.1 installed, is to upgrade to PHP 4.2.2.

For more information see the alert from the discover of the vulnerability, Stefan Esser of e-matters GmbH, or the security advisory from the php team.

CERT Advisory: CA-2002-21 Vulnerability in PHP

Alerts:

SuSE

SuSE-SA:2003:0009

2003-02-18

(Log in to post comments)

PHP Remote Compromise/DOS Vulnerability

Posted Aug 1, 2002 17:01 UTC (Thu) by strombrg (guest, #2178) [Link]

We have reason to believe that earlier versions of PHP are DOSable too.

We're using 4.1.2, and we got massively DOSed across our campus in two big bursts one weekend.

One of our students tried the 4.2.x exploit against our 4.1.2, and he said it worked.