Description: rgod has discovered a vulnerability in PHP's Interbase extension, which can be exploited by malicious users to gain escalated privileges.
The vulnerability is caused due to a boundary error when processing arguments passed to "isc_attach_database()" in GDS32.DLL located in the PHP directory when the Interbase extension is installed. This can be exploited to cause a stack-based buffer overflow via an overly long (greater than 260 bytes) string passed as argument to e.g. PHP's "ibase_connect()" or "ibase_pconnect()" functions and execute arbitrary code therefore bypassing security restrictions like the "disable_functions" directive.
Successful exploitation requires that the Interbase extension is installed.
The vulnerability is reported in PHP 4.4.6 and confirmed in the PHP-5.2.1 win32 installer. Other versions may also be affected.
Solution: Grant only trusted users permissions to execute PHP code.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
