Description: rgod has discovered a vulnerability in PHP's MSSQL Extension, which can be exploited to bypass certain security restrictions.
The vulnerability is caused due to a boundary error when processing arguments within the "dbopen()" function in NTWDBLIB.DLL located in the PHP directory when the MSSQL extension is installed. This can be exploited to cause a stack-based buffer overflow via an overly long (greater than 260 bytes) string passed as argument to e.g. PHP's "mssql_connect()" or "mssql_pconnect()" functions and execute arbitrary code therefore bypassing security restrictions like the "disable_functions" directive.
Successful exploitation requires that the MSSQL extension is installed.
The vulnerability is reported in PHP 4.4.6 and confirmed in the PHP-5.2.1 win32 installer. Other versions may also be affected.
Solution: Grant only trusted users access to the affected system.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
