|
PHP Session Handling Double Free Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA24505
|
|
|
Release Date:
|
2007-03-15
|
|
Last Update:
|
2007-05-04
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
System access
|
|
Where:
|
Local system
|
|
Solution Status:
|
Partial Fix
|
|
| Software: | PHP 4.4.x
PHP 5.0.x
PHP 5.1.x
PHP 5.2.x
|
| | CVE reference: | CVE-2007-1521 (Secunia mirror)
CVE-2007-1522 (Secunia mirror)
|
|
|
|
|
|
Description:
Stefan Esser has reported some vulnerabilities in PHP, which can be exploited by malicious users to compromise a vulnerable system.
1) A double free error within the "session_regenerate_id()" function can be exploited to execute arbitrary code with the privileges of the PHP interpreter.
2) A double free error within the handling of rejected sessions in PHP's internal storage module can be exploited to execute arbitrary code with the privileges of the PHP interpreter.
Successful exploitation requires that a user can e.g. upload and execute malicious PHP scripts. Remote exploitation may be possible, but has not currently been proven.
The vulnerabilities are reported in version 5.2.0 and 5.2.1, vulnerability #1 potentially also affects version 4.x. Other versions may also be affected.
Solution:
Update to version 5.2.2 or 4.4.7 to fix vulnerability #1. Allow only trusted users to upload and execute PHP scripts.
Provided and/or discovered by:
Stefan Esser
Changelog:
2007-03-26: Added CVE reference.
2007-05-03: Updated "Solution" and "Description" section. Added vulnerable version 4.x.
Original Advisory:
PHP:
http://www.php.net/releases/5_2_2.php
http://www.php.net/releases/4_4_7.php
MOPB:
http://www.php-security.org/MOPB/MOPB-22-2007.html
http://www.php-security.org/MOPB/MOPB-23-2007.html
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
44 Related Secunia Security Advisories, displaying 10
|
|
|
1. PHP Multiple Vulnerabilities
|
|
2. PHP Multiple Vulnerabilities
|
|
3. PHP Multiple Vulnerabilities
|
|
4. PHP COM Objects Security Bypass
|
|
5. PHP Multiple Vulnerabilities
|
|
6. PHP "glob()" Code Execution Vulnerability
|
|
7. PHP Multiple Extensions Buffer Overflow Vulnerabilities
|
|
8. PHP Integer Overflow Vulnerability and Security Bypass
|
|
9. PHP crypt() Race Condition Vulnerability
|
|
10. PHP "gdPngReadData()" Truncated PNG Data Denial of Service
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
