OSVDB ID: 32771

Title: PHP unserialize() ZVAL Reference Counter Remote Overflow

Info

Disclosure
Mar 02, 2007

Discovery
Unknown

Dates

Exploit
Mar 02, 2007

Solution
Unknown

Description

 PHP contains a flaw that may a context-dependent attacker to elevate privileges. The issue can occur when the unserialize() function is used on an attacker supplied string, which can result in an integer overflow in the refcount variable in _zval_struct through the creation of a large number of references for a specific variable leading to a double destruction of the underlying variable. It is possible that the flaw may allow a remote attacker to execute arbitrary code resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Upgrade to version 4.4.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

The PHP Group

PHP

 4.4.6
4.4.5
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0
4.3.x
4.2.x
4.1.x
4.0.x
4.0, Release Candidate 2
4.0, Release Candidate 1
4.0 Beta 4
4.0 Beta 3
4.0 Beta 2
4.0 Beta 1

References

Credit
  • Stefan Esser - sesserhardened-php.net - www.hardened-php.net


Direct URL: http://osvdb.org/32771