There have been a number of reports circulating about possible vulnerabilities in PHP. I'm going to address them one-by-one: * Integer Overflow in socket_iovec_alloc() WRONG! This is a Null-pointer de-reference: EAX = 00000000 EDI = 41414141 0085353A 8B 38 mov edi,dword ptr [eax] The access violation occurs in a read error. This is not exploitable to gain control of the PHP interpreter, nor is it an integer overflow of any kind. It is simply a null-read, and the lone register controlled by user data is obliterated by that instruction if the call succeeds. * Buffer overflow in openlog() I've tried passing long parameters (and large integers) to openlog(). No crashes could be caused by this "exploit". I was unable to demonstrate any disruption to PHP via this "vulnerability", let alone complete control. Unless the vendor or the original reporter will confirm this with code (which was, oddly enough, MISSING from the original advisory), I don't believe this "flaw" (if it exists) can do any damage to a default production system. * Integer overflow in emalloc() Funny -- there is not an emalloc() function (nor malloc, calloc, etc.) because ALL memory allocation is handled by the interpreter itself. Therefore, this report is completely bogus. -------------------------------------------------------------------- mail2web - Check your email from the web at http://mail2web.com/ .
This archive was generated by hypermail 2b30 : Wed Apr 02 2003 - 13:33:12 PST