Stefan Esser has discovered some vulnerabilities in PHP4, which can be exploited by malicious, local users to bypass certain security restrictions, and by malicious people to conduct cross-site scripting attacks.

1) The vulnerability is caused due to an integer overflow in the handling of ZVAL structures. This can be exploited to corrupt memory and execute arbitrary code therefore bypassing security restrictions like the "disable_functions" directive.

The vulnerability is confirmed in version 4.4.6. Other versions may also be affected.

2) Input passed via array parameters is not properly sanitised before being returned to the user within a "phpinfo()" call. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site via a script calling "phpinfo()".

This is related to:
SA17371 (vulnerability #3)
SA19599 (vulnerability #1)

The vulnerability is confirmed in version 4.4.6 and also reported in versions 4.4.3 through 4.4.6. Other versions may also be affected.

Solution
Update to version 4.4.7 to fix vulnerability #2. Grant only trusted users access to affected systems. PHP scripts calling "phpinfo()" should not be publicly accessible on production systems.

Provided and/or discovered by
Stefan Esser

Changelog
Further details available in Customer Area

Original Advisory
PHP:
http://www.php.net/releases/4_4_7.php

MOPB:
1) http://www.php-security.org/MOPB/MOPB-01-2007.html
2) http://www.php-security.org/MOPB/MOPB-08-2007.html

Deep Links
Links available in Customer Area