CERT-MU :Vulnerability

Home | Search | FAQ | Site Map | Contact Us

|| Hotline : 800 2378 || To contact CERT-MU send e-mail on --> info[at]cert-mu.gov.mu || To report incident e-mail on --> incident[at]cert-mu.gov.mu || To report Vulnerabilities send e-mail on --> Vulnerability[at]cert-mu.gov.mu ||

Charter & Mission

CERT-MU Services

Constituency

Authority

Incident Reporting

Vulnerability Reporting

Incident Statistics Forms

Vol. 2, Feb 2012

Vol. 1, Oct 2011

World CERTs

Security Sites

Security Tools

Antivirus Resources

Email Abuse

Network Abuse

Anti-Spam Initiative

Cyber Security Portal

Safer Internet Day

Computer Security Day

National Computer Board

Authorized to use CERT(TM) - CERT is a mark owned by Carnegie Mellon University

CERT-MU Vulnerability Note VN-2008-16

‘mbstring’ Buffer Overflow and XSS vulnerabilities in PHP

Original Issue Date: January 13, 2009

Severity Rating: High

Systems Affected

PHP version prior to 5.2.7

Overview

Multiple vulnerabilities have been reported in PHP which could allow attacker to execute arbitrary code and to take complete control of a vulnerable system.

Description

1. mbstring Buffer Overflow Vulnerability

A heap overflow vulnerability has been reported in the multibyte string extension(mbstring package) for PHP. The vulnerability is due to the improper bound checking by the mb_convert_encoding(), mb_check_encoding(), mb_convert_variables() and mb_parse_str() functions when converting strings with HTML entities into Unicode strings.

A remote attacker could exploit this vulnerability using a specially-crafted string containing an HTML entity to execute arbitrary code in the context of affected webserver or cause the affected application to crash.

2. Cross-site scripting (XSS) vulnerability A Cross-site scripting (XSS)

vulnerability has been reported in PHP 5.2.7 and earlier, when display_errors is enabled which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

To workaround this vulnerability:

Set display_errors=off in php.ini configuration file.