OSVDB ID: 32776

Title: PHP Session Extension php_binary Heap Information Disclosure

Info

Disclosure
Feb 09, 2007

Discovery
Unknown

Dates

Exploit
Mar 05, 2007

Solution
Unknown

Description

 The php_binary serialization handler in the PHP session extension is missing a boundary check and may lead to an unauthorized information disclosure. The condition is triggered during the extraction of an overly long php_binary session data format variable name, which will disclose up to 126 bytes of heap data into PHP variables, resulting in a loss of confidentiality.

Classification

 Location: Remote / Network Access
Attack Type: Information Disclosure
Impact: Loss of Confidentiality
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Concern

Solution

 Upgrade to PHP versions 4.4.5 or higher and PHP 5.2.1 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

The PHP Group

PHP

 5.2.1
5.2.0
5.1.x
5.0.x
5.0 Release Candidate 3
5.0 Release Candidate 2
5.0 Release Candidate 1
5.0 Beta 4
5.0 Beta 3
5.0 Beta 2
5.0 Beta 1
4.4.6
4.4.5
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0
4.3.x
4.2.x
4.1.x
4.0.x
4.0, Release Candidate 2
4.0, Release Candidate 1
4.0 Beta 4
4.0 Beta 3
4.0 Beta 2
4.0 Beta 1
3.x

References

Credit
  • Stefan Esser - sesserhardened-php.net - www.hardened-php.net


Direct URL: http://osvdb.org/32776