CERT-In Advisory
CIAD-2014-0063
Multiple Vulnerabilities in PHP
Original Issue Date: October 22, 2014
Severity Rating: High
Systems Affected
- PHP 5.6.x version prior to 5.6.2
- PHP 5.5.x version prior to 5.5.18
- PHP 5.4.x version prior to 5.4.34
Overview
Multiple vulnerabilities have been reported in PHP which allow a remote attacker to cause denial of service conditions and possibly compromise the target system.
Description
1. Buffer Overflow Vulnerability
(
CVE-2014-3668
)
This vulnerability exists in "mkgmtime()" function of the XMLRPC module in PHP due to insufficient address sanitization and due to multiple boundary errors in the "date_from_ISO8601()" function. A remote attacker could exploit this vulnerability, possibly causing the PHP interpreter to crash.
2. Integer overflow Vulnerability in unserialize() function
(
CVE-2014-3669
)
This vulnerability exists due to integer overflow error in "unserialize()" in "var_unserializer.c" in PHP when parsing specially crafted serialized data. Successful exploitation could allow a remote attacker by triggering an out-of-bounds memory read access, to cause denial of service conditions (DoS), or disclose sensitive information or possibly compromise the target system.
NOTE: This vulnerability is present in 32 bit systems only
3. Heap corruption Vulnerability in exif_thumbnail() function
(
CVE-2014-3670
)
This vulnerability exists in exif_thumbnail API of PHP while writing out an array of floating point values. A remote attacker could exploit this vulnerability to cause a heap corruption when parsing the thumbnail of a specially crafted .jpg image. Successful exploitation could allow the remote attacker to cause denial of service conditions (DoS) on the target system.
Solution
Apply appropriate patches as issued by vendor
https://bugs.php.net/bug.php?id=68044
https://bugs.php.net/bug.php?id=68113
https://bugs.php.net/bug.php?id=68027
Vendor Information
PHP
https://bugs.php.net/bug.php?id=68027
https://bugs.php.net/bug.php?id=68044
https://bugs.php.net/bug.php?id=68113
References
High-Tech bridge
https://www.htbridge.com/blog/cve_2014_3669_integer_overflow_in_unserialize_php_function.html
CVE Name
CVE-2014-3668
CVE-2014-3669
CVE-2014-3670
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|