ematters security securityemattersde ematters gmbh wwwemattersde security advisory advisory remote compromisedos vulnerability php release date 20020722 last modified 20020722 author stefan esser sesseremattersde application php 420 421 severity vulnerability within multipartformdata handler could allow remote compromise web server risk critical vendor status patches released reference httpsecurityemattersdeadvisories022002html overview discovered serious vulnerability within default version php depending processor architecture may possible remote attacker either crash compromise web server details php 420 introduced completely rewritten multipartformdata post handler working code role php developer found bug within way mime headers processed malformed post request trigger error condition correctly handled due bug could happen uninit ialised struct gets appended linked list mime headers lists gets cleaned destroyed php tries free pointers expected struct lack initialisation pointers contain stuff left stack previous function calls ia32 architecture aka x86 possible control end uninitialised struct stack layout possible code paths leave illegal addresses within struct php crash tries free unfortunately situation absolutely different look solaris sparc installation possible attacker free chunks memory full control probably case several non ia32 architectures please note exploitability limited systems running mallocfree implementations known vulnerable control structure overwrites internal php memory managment implements linked list system used overwrite nearly arbitrary memory addresses proof concept ematters going release exploit vulnerability public vendor response 22th july 2002 updated version php fixes vulnerability released downloaded httpwwwphpnetdownloadsphp vendor announcement available httpwwwphpnetrelease_4_2_2php recommendation running php 42x upgrade soon possible especially server runs non ia32 cpu upgrade whatever reason way workaround disable kinds post requests server gpgkey httpsecurityemattersdegpg_keyasc pub 1024d75e7aad6 20020226 ematters gmbh securityteam key fingerprint 43dd 843c fab9 832a e5ab caeb 81f2 8110 75e7 aad6 copyright 2002 stefan esser rights reserved mon 22 jul 2002 132128 0200 vulnwatch advisory 022002 php remote vulnerability