Secunia

rgod has discovered a vulnerability in PHP's Interbase extension, which can be exploited by malicious users to gain escalated privileges.

The vulnerability is caused due to a boundary error when processing arguments passed to "isc_attach_database()" in GDS32.DLL located in the PHP directory when the Interbase extension is installed. This can be exploited to cause a stack-based buffer overflow via an overly long (greater than 260 bytes) string passed as argument to e.g. PHP's "ibase_connect()" or "ibase_pconnect()" functions and execute arbitrary code therefore bypassing security restrictions like the "disable_functions" directive.

Successful exploitation requires that the Interbase extension is installed.

The vulnerability is reported in PHP 4.4.6 and confirmed in the PHP-5.2.1 win32 installer. Other versions may also be affected.

Solution
Grant only trusted users permissions to execute PHP code.

Provided and/or discovered by
rgod

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/3488

Deep Links
Links available in Customer Area