CERT-MU :Advisories

Home | Search | FAQ | Site Map | Contact Us

|| Hotline : 800 2378 || To contact CERT-MU send e-mail on --> info[at]cert-mu.gov.mu || To report incident e-mail on --> incident[at]cert-mu.gov.mu || To report Vulnerabilities send e-mail on --> Vulnerability[at]cert-mu.gov.mu ||

Charter & Mission

CERT-MU Services

Constituency

Authority

Incident Reporting

Vulnerability Reporting

Incident Statistics Forms

Vol. 2, Feb 2012

Vol. 1, Oct 2011

World CERTs

Security Sites

Security Tools

Antivirus Resources

Email Abuse

Network Abuse

Anti-Spam Initiative

Cyber Security Portal

Safer Internet Day

Computer Security Day

National Computer Board

Authorized to use CERT(TM) - CERT is a mark owned by Carnegie Mellon University

CERT-MU AD-2008-14

Multiple vulnerabilities in PHP

Original Issue Date: 20th August 2008

Overview

Multiple vulnerabilities have been reported in PHP, since the application fails to perform adequate boundary checks on user-supplied data, which could be exploited by a remote attacker to cause Denial of Service.

Description

1. imageloadfont function Buffer Overflow vulnerability

A Buffer Overflow vulnerability has been reported in the “imageloadfont” function in “ext/gd/gd.c” in PHP. A remote attacker can exploit this issue to cause a Denial of Service (crash) via a crafted font file.

2. memnstr function Buffer Overflow vulnerability

A Buffer Overflow vulnerability exists in the “memnsttr()” function in PHP. A remote attacker can exploit this issue to cause a Denial of Service (crash) via a delimiter argument to the explode function.

3. Denial of Service Vulnerability

A vulnerability has been reported in PHP, when used as a FastCGI module. This could be exploited by remote attacker to cause a denial of service via a request with multiple dots preceding the extension.

Affected systems

PHP versions prior to 4.4.9

Impact

imageloadfont function Buffer Overflow vulnerability

Allows unauthorized disclosure of information, allows unauthorized modification , allows disruption of service.

memnstr function Buffer Overflow vulnerability

Allows unauthorized modification, allows disruption of service

Denial of Service Vulnerability

Allows disruption of service

Solution

Upgrade PHP to version 4.4.9
http://www.php.net/downloads.php#v4

Disclaimer