PHP 5.2.x Remote Code Execution Vulnerability



Release Date: 17 February 2012
Affected Versions: 5.2.0 - 5.2.17 (unsupported version)

------------------------------------------------------------------------------------------

Description:

If PHP bails out in startup stage before setting PG(modules_activated)
to 1, the filter_globals struct is not cleaned up on shutdown stage.
The subsequence request will use uncleaned value in filter_globals
struct. With special crafted request, this problem can lead to
information disclosure and remote code execution.

Only apache modules SAPI are found to vulnerable to this problem.
While other SAPIs are safe because a PHP process exits when PHP bails
out before setting PG(modules_activated) to 1.

This bug was fixed before releasing 5.3.0.
http://svn.php.net/viewvc?view=revision&revision=279522. But the patch
is not backported to 5.2 version as described in
https://bugs.php.net/bug.php?id=47930.

------------------------------------------------------------------------------------------

Solution:

Upgrade to 5.3

------------------------------------------------------------------------------------------

Workaround:

If you still need to use PHP 5.2.x, I recommend to use cgi SAPI.

If you still need to use PHP 5.2.x as apache module, installing
Suhosin patch AND extension should help you.
Just only Suhosin patch, it still seems exploitable but much more difficult.

------------------------------------------------------------------------------------------

Vendor Response:

The final release of PHP 5.2 was in January 2011. We are not planning
any further releases.


Worawit Wangwarunyoo



Relevant Pages

  • Advisory 02/2002: PHP remote vulnerability
    ... Application: PHP 4.2.0, 4.2.1 ... Vendor Status: Patches Released. ... We have discovered a serious vulnerability within the default version ... ialised struct gets appended to the linked list of mime headers. ...
    (Bugtraq)
  • [VulnWatch] Advisory 02/2002: PHP remote vulnerability
    ... Application: PHP 4.2.0, 4.2.1 ... Vendor Status: Patches Released. ... We have discovered a serious vulnerability within the default version ... ialised struct gets appended to the linked list of mime headers. ...
    (VulnWatch)
  • Re: System for generating C/C++ references?
    ... > or PHP) references for a given project. ... > struct and where's that struct defined. ... > to grep kernel sources every time I want to find something. ... > I am sure I have seen projects like this, ...
    (freebsd-questions)
  • Re: mysql_insert_id() is it not problematic?
    ... Does each PHP thread use a different persistant ... The persistent connection list is stored in the "persistent_list" member of a ... struct called "executor_globals". ... From looking through the PHP source code, ...
    (comp.lang.php)