rgod has discovered a vulnerability in PHP's MSSQL Extension, which can be exploited to bypass certain security restrictions.

The vulnerability is caused due to a boundary error when processing arguments within the "dbopen()" function in NTWDBLIB.DLL located in the PHP directory when the MSSQL extension is installed. This can be exploited to cause a stack-based buffer overflow via an overly long (greater than 260 bytes) string passed as argument to e.g. PHP's "mssql_connect()" or "mssql_pconnect()" functions and execute arbitrary code therefore bypassing security restrictions like the "disable_functions" directive.

Successful exploitation requires that the MSSQL extension is installed.

The vulnerability is reported in PHP 4.4.6 and confirmed in the PHP-5.2.1 win32 installer. Other versions may also be affected.

Solution
Grant only trusted users access to the affected system.

Provided and/or discovered by
rgod

Changelog
Further details available in Customer Area

Original Advisory
http://retrogod.altervista.org/php_446_mssql_connect_bof.html

Deep Links
Links available in Customer Area