Technical Description

Multiple vulnerabilities were identified in PHP, which may be exploited by attackers to conduct denial of service or bypass certain security restrictions.

- The first problem resides in the "swf_openfile()", and could be exploited to bypasses safe mode restrictions. In conjunction with application vulnerabilities this could potentially allow overwriting arbitrary files.

- The second vulnerability resides in the "php_handle_iff()" and "php_handle_jpeg()" (ext/standard/image.c) functions reachable from the PHP function getimagesize(), which may be exploited by remote attackers to consume 100% CPU resources on a vulnerable system.

- The third issue is due to an integer overflow error in the "exif_process_IFD_TAG()" function (exif.c), which may be exploited by attackers to execute arbitrary code via an application processing EXIF tags of uploaded images.

Affected Products

PHP version 4.2.2 and prior
PHP version 4.3.10 and prior
PHP version 5.0.3 and prior

Solution

PHP version 4.3.11 or version 5.0.4 :
http://www.php.net/downloads.php

References

http://www.vupen.com/english/advisories/2005/0305
http://www.php.net/release_4_3_11.php
http://www.php.net/ChangeLog-5.php
http://www.idefense.com/application/poi/display?id=222&type=vulnerabilities

Credits

Vulnerabilities reported by iDefense

ChangeLog

2005-04-01 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.