Everything
php
Learn Community Releases The PHP Project
Home » Project » Newsgroups » php.internals » Serious PHP crash, vaulnarable for every script. »

Serious PHP crash, vaulnarable for every script.

php.internals

Simon Ejsing

23 years ago
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've discovered a serious flaw and possibly a security issue in PHP. It is possible, by making a simple request to a PHP page, to crash the PHP thread with a Segmentation fault, no matter what the script does as it crashes before execution. I'm using PHP version 4.3.2 with Apache 2.0.46 on Linux, and have not found anything about this issue in the bug system. I have not tested with any other version, nor have I looked into a specific configuration to avoid this problem. I'm not sure where to report this issue, I don't want to explain how to do this to everyone, so if I could contact a developer personally I could explain the simple procedure. - -- Simon Ejsing, Systemudvikler esoft ApS, http://www.esoft.dk Kongensgade 66-68, DK-5000 Odense C. Tlf: 70 222 466, Fax: 63 122 466 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE++sKv0ZtqfKNZvaARAvs1AJwJpkBTVJLkPB1bSgbXM+it0ophyACfcAgL bp/REaKd9w792qGx6D7WYRE= =yiK0 -----END PGP SIGNATURE-----

Derick Rethans

23 years ago
On Thu, 26 Jun 2003, Simon Ejsing wrote:
> I've discovered a serious flaw and possibly a security issue in PHP. It is > possible, by making a simple request to a PHP page, to crash the PHP thread > with a Segmentation fault, no matter what the script does as it crashes > before execution. > > I'm using PHP version 4.3.2 with Apache 2.0.46 on Linux, and have not found > anything about this issue in the bug system. I have not tested with any other > version, nor have I looked into a specific configuration to avoid this > problem. > > I'm not sure where to report this issue, I don't want to explain how to do > this to everyone, so if I could contact a developer personally I could > explain the simple procedure.
Please contact security@php.net about this issue. regards, Derick
-- "Interpreting what the GPL actually means is a job best left to those that read the future by examining animal entrails." ------------------------------------------------------------------------- Derick Rethans http://derickrethans.nl/ International PHP Magazine http://php-mag.net/ -------------------------------------------------------------------------

moshe doron

23 years ago
ummp, sorry for my ignorant, when segfualt consider as "potential security report"? i put similar (?) example in the past on the bugs.php.net that's live there open about 2 month's till wez fix it, without considering the last sascha integer overflow hunting project...
-- moshe "Simon Ejsing" <simon@esoft.dk> wrote in message news:200306261153.51981.simon@esoft.dk... -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've discovered a serious flaw and possibly a security issue in PHP. It is possible, by making a simple request to a PHP page, to crash the PHP thread with a Segmentation fault, no matter what the script does as it crashes before execution. I'm using PHP version 4.3.2 with Apache 2.0.46 on Linux, and have not found anything about this issue in the bug system. I have not tested with any other version, nor have I looked into a specific configuration to avoid this problem. I'm not sure where to report this issue, I don't want to explain how to do this to everyone, so if I could contact a developer personally I could explain the simple procedure. - -- Simon Ejsing, Systemudvikler esoft ApS, http://www.esoft.dk Kongensgade 66-68, DK-5000 Odense C. Tlf: 70 222 466, Fax: 63 122 466 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE++sKv0ZtqfKNZvaARAvs1AJwJpkBTVJLkPB1bSgbXM+it0ophyACfcAgL bp/REaKd9w792qGx6D7WYRE= =yiK0 -----END PGP SIGNATURE-----

shimi

23 years ago
every program that crashes due to overwriting of memory it should not overwrite is subject to overwrite the registers that control the flow of the program, and might, upon user input, execute arbitrary code. the real question is how much can you effect the flow of the program - that depends on where the bug is, and how much the user input to the code is being limited, so before a check, every segfault *might* have security issues behind... On Thu, 26 Jun 2003, moshe doron wrote:
> ummp, sorry for my ignorant, when segfualt consider as "potential security > report"? > > i put similar (?) example in the past on the bugs.php.net that's live there > open about 2 month's till wez fix it, without considering the last sascha > integer overflow hunting project... > > -- > moshe > > "Simon Ejsing" <simon@esoft.dk> wrote in message > news:200306261153.51981.simon@esoft.dk... > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > I've discovered a serious flaw and possibly a security issue in PHP. It is > possible, by making a simple request to a PHP page, to crash the PHP thread > with a Segmentation fault, no matter what the script does as it crashes > before execution. > > I'm using PHP version 4.3.2 with Apache 2.0.46 on Linux, and have not found > anything about this issue in the bug system. I have not tested with any > other > version, nor have I looked into a specific configuration to avoid this > problem. > > I'm not sure where to report this issue, I don't want to explain how to do > this to everyone, so if I could contact a developer personally I could > explain the simple procedure. > > - -- > Simon Ejsing, Systemudvikler > esoft ApS, http://www.esoft.dk > Kongensgade 66-68, DK-5000 Odense C. > Tlf: 70 222 466, Fax: 63 122 466 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (GNU/Linux) > > iD8DBQE++sKv0ZtqfKNZvaARAvs1AJwJpkBTVJLkPB1bSgbXM+it0ophyACfcAgL > bp/REaKd9w792qGx6D7WYRE= > =yiK0 > -----END PGP SIGNATURE----- > > > >
-- Best regards, Shimi ---- "Outlook is a massive flaming horrid blatant security violation, which also happens to be a mail reader." "Sure UNIX is user friendly; it's just picky about who its friends are."

moshe doron

23 years ago
> limited, so before a check, every segfault *might* have security issues > behind...
in the bottom line, there were, there'll and probably there are such "security issues" where the dealing is publicly/ in contrary there was in the past file uploading issue that cause to role pl. where is the difference? the size of the overriding memory?
-- moshe.

Sascha Schumann

23 years ago
On Thu, 26 Jun 2003, moshe doron wrote:
> > > limited, so before a check, every segfault *might* have security issues > > behind... > > in the bottom line, there were, there'll and probably there are > such "security issues" where the dealing is publicly/ in > contrary there was in the past file uploading issue that cause > to role pl. where is the difference? the size of the overriding > memory?
There is a traditional difference between local and remote exploits. It is a significant security issue, if a bug can be triggered by a remote user on any PHP enabled site. It is of less significance (albeit not completely irrelevant), if a local user who can create arbitrary PHP scripts can cause such a event. - Sascha

shimi

23 years ago
usually people with some responsibility in mind won't disclose a bug that might cause system to be penetrated, before the vendor had enough time to respond with an answer to the bug. if the bug he found might be a bug that would result in every server running PHP to be cracked, that's not good. The better thing to be is that he'll contact the PHP security team, which will fix the bug, roll out a new release which does not have the bug, announce that there is a security bug and that everyone should upgrade, and only something like a month afterwards, the author should post an advisory about the bug to the world, after people had the chance to protect themselves. of course, it is possible that the bug he found can't do anything to php, and in that case, i assume the security@ people will add it to the bugs.php.net database or something like that... On Thu, 26 Jun 2003, moshe doron wrote:
> > > limited, so before a check, every segfault *might* have security issues > > behind... > > in the bottom line, there were, there'll and probably there are such "security issues" where the dealing is publicly/ > in contrary there was in the past file uploading issue that cause to role pl. where is the difference? the size of the overriding memory? > > -- > moshe. >
-- Best regards, Shimi ---- "Outlook is a massive flaming horrid blatant security violation, which also happens to be a mail reader." "Sure UNIX is user friendly; it's just picky about who its friends are."

Rasmus Lerdorf

23 years ago
Note that the bug is against a platform we strongly advise against using in any sort of production environment. Not that we shouldn't fix it if anybody can reproduce it (which I haven't heard anybody say they could), but there is a reason we are still telling people not to use Apache2+PHP in production. -Rasmus On Thu, 26 Jun 2003, shimi wrote: