PHP contains a flaw in the Zend engine that may allow a remote denial of service. The issue is due to the application not enforcing sanity checks for the depth of nested arrays. With a specially crafted request containing deeply nested arrays that triggers deep recursion in the variable destruction routines, a remote attacker can cause a stack exhaustion.
Classification
Location:
Remote / Network Access
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Availability
Solution:
Upgrade
Exploit:
Exploit Public
Disclosure:
Vendor Verified
OSVDB:
Web Related
Solution
Upgrade to version 4.4.8, 5.2.2 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Configure your web application firewall to drop high amounts of '[' in variable names.
