cert advisory certadvisorycertorg begin pgp signed message cert advisory ca200221 vulnerability php original release date july 22 2002 last revised source certcc complete revision history found end file systems affected systems running php versions 420 421 overview vulnerability discovered php vulnerability could used remote attacker execute arbitrary code crash php andor web server description php popular scripting language widespread use information php see httpwwwphpnetmanualenfaqgeneralphp vulnerability occurs portion php code responsible handling file uploads specifically multipartformdata sending specially crafted post request web server attacker corrupt internal data structures used php specifically intruder cause improperly initialized memory structure freed cases intruder use flaw crash php web server circumstances intruder may able take advantage flaw execute arbitrary code privileges web server may aware freeing memory inappropriate times implementations malloc free usually result execution arbitrary code however php utilizes memory management system implementation malloc free irrelevant problem stefan esser ematters gmbh indicated intruders execute code x86 systems however encourage system administrators apply patches x86 systems well guard denialofservice attacks asyetunknown attack techniques may permit execution code x86 architectures vulnerability discovered ematters gmbh described detail advisory php group also issued advisory list vendors contacted certcc status regarding vulnerability available vu929115 although vulnerability affects php 420 421 ematters gmbh previously identified vulnerabilities older versions php running older versions php encourage review httpsecurityemattersdeadvisories012002html ii impact remote attacker execute arbitrary code vulnerable system attacker may able execute code x86 architectures due way stack structured however attacker leverage vulnerability crash php andor web server running x86 architecture iii solution apply patch vendor appendix contains information provided vendors advisory vendors report new information certcc update section note changes revision history particular vendor listed received comments please contact vendor directly upgrade latest version php patch available vendor upgrade version 422 deny post requests patches update applied may wish deny post requests following workaround taken php security advisory php applications affected web server rely http post input user agents often possible deny post requests web server apache web server example possible following code included main configuration file toplevel htaccess file order denyallow deny note existing configuration andor htaccess file may parameters contradicting example given disable vulnerable service upgrade apply patches may wish disable php best practice certcc recommends disabling services explicitly required deciding disable php carefully consider service requirements appendix vendor information appendix contains information provided vendors advisory vendors report new information certcc update section note changes revision history particular vendor listed received comments apple computer inc mac os x mac os x server shipping php version 412 contain vulnerability described alert caldera caldera openlinux provide either vulnerable version 420 421 php products therefore caldera products vulnerable issue compaq computer corporation source compaq computer corporation whollyowned subsidiary hewlettpackard company hewlettpackard company hp services software security response team xref ssrt2300 php post requests time writing document compaq currently investigating potential impact compaqs released operating system software products information becomes available compaq provide notice availability necessary patches standard security bulletin announcements available normal hp services supportchannel cray inc cray inc supply php systems debian debian gnulinux stable aka 30 vulnerable debian gnulinux testing vulnerable debian gnulinux unstable vulnerable problem effects php versions 420 421 woody ships older version php 412 doesnt contain vulnerable function freebsd freebsd include version php default vulnerable however freebsd ports collection contain php4 package updates php4 package progress corrected package available near future guardian digital guardian digital shipped php 42x versions engarde therefore believed vulnerable time hewlettpackard company source hewlettpackard company security response team time writing document hewlett packard currently investigating potential impact hps released operating system software products information becomes available hp provide notice availability necessary patches standard security bulletin announcements available normal hp services support channel ibm ibm vulnerable vulnerabilities php supply php packages aix aix toolbox linux applications however packages 406 also incorporate security patch 2272002 mandrakesoft mandrake linux ship php version 42x vulnerable mandrake linux cooker currently contain php 421 updated shortly cooker used production environment advisory issued microsoft corporation microsoft products affected issues detailed advisory network appliance netapp products vulnerable red hat inc none commercial releases ship vulnerable versions php 420 421 suse inc suse linux vulnerable problem ship php 42x _________________________________________________________________ certcc acknowledges ematters gmbh discovering reporting vulnerability _________________________________________________________________ author ian finlay ______________________________________________________________________ document available httpwwwcertorgadvisoriesca200221html ______________________________________________________________________ certcc contact information email certcertorg phone 1 4122687090 24hour hotline fax 1 4122686989 postal address cert coordination center software engineering institute carnegie mellon university pittsburgh pa 152133890 usa certcc personnel answer hotline 08001700 estgmt5 edtgmt4 monday friday call emergencies hours us holidays weekends using encryption strongly urge encrypt sensitive information sent email public pgp key available httpwwwcertorgcert_pgpkey prefer use des please call cert hotline information getting security information cert publications security information available web site httpwwwcertorg subscribe cert mailing list advisories bulletins send email majordomocertorg please include body message subscribe certadvisory cert cert coordination center registered us patent trademark office ______________________________________________________________________ warranty material furnished carnegie mellon university software engineering institute furnished basis carnegie mellon university makes warranties kind either expressed implied matter including limited warranty fitness particular purpose merchantability exclusivity results obtained use material carnegie mellon university make warranty kind respect freedom patent trademark copyright infringement _________________________________________________________________ conditions use disclaimers sponsorship information copyright 2002 carnegie mellon university revision history july 22 2002 initial release begin pgp signature version pgp 658 iqcvawubptyovqcvpmxqi2hjaqgk6qqap1rr7k18pnxpqzvqkpywxyrtpit8mmkn uuyermoox5mawh0hbawcvvcylh0gkgbtpbkrgtot8iehzojwhczqoamm9knifg qeveznlfbx4gigzgpu0xwlph3zqaaywln57egueyz26zburiiuu2cucmyygqkqli tuzdndqumr0 829 end pgp signature mon 22 jul 2002 191124 0400 edt cert advisory ca200221 vulnerability php