-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2007.0014                  AUSCERT Advisory

                             [Win][UNIX/Linux]
                       PHP multiple vulnerabilities
                               2 March 2007
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              PHP 5.2.1 and prior
                      PHP 4.4.6 and prior
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Denial of Service
                      Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-1549
Member content until: Friday, March 30 2007


OVERVIEW:

	Several vulnerabilities in PHP, some of which are still unpatched,
	potentially allow remote denial of service and local execution of
	arbitrary code.


IMPACT:

	A remote attacker may cause the server to crash, terminating all 
	active threads resulting in a denial of service. 

	A local attacker with the ability to run PHP code on the system 
	may bypass PHP security restrictions and execute arbitrary code. 


MITIGATION:

	For issues 1 and 2 listed below no PHP patch is available as yet.
	The Hardened PHP Project Suhosin patch and extension provides a
	workaround by preventing these attacks.

	Issue 3 is fixed in PHP 4.4.6, which is now available. [1]

	For issue 4 no PHP patch is yet available.


DETAILS:

	1. In all current versions of PHP, if a web application contains 
	   a recursive function that can be caused to recurse deeply in 
	   processing user input, stack may be exhausted causing a denial 
	   of service. As reported in [3], this is possible in several 
	   popular PHP web applications.
	    
	2. In all current versions of PHP, variables are destroyed recursively.
	   If an attacker can cause the engine to create a variable which has 
	   a deeply nested array structure, it will exhaust the stack when the 
	   variable is deleted, causing a denial of service. One situation 
	   where this will occur is if register_globals is on, and the 
	   attacker supplies a deeply nested array variable. [4]

	3. In PHP 4.4.5 and prior, If register_globals is enabled then a 
	   vulnerability in the session extension potentially allows a 
	   remote attacker to crash the server. [1]

	4. In PHP 4.x, if an attacker can cause more than 65535 references
	   to a variable to be created, overflow of the reference counter
	   will cause the variable to be deallocated twice. The resulting 
	   memory corruption allows execution of arbitrary code. [2]
	    
	   In the case of most web applications this vulnerability can not 
	   be exploited remotely. An attacker who can run PHP code on 
	   the web server may use this vulnerability to execute arbitrary 
	   code, bypassing PHP security restrictions.

	   There are some situations in which this vulnerability can be
	   exploited remotely. In older PHP versions 4.4.4 and prior 
	   applications which use unserialize() on user supplied data are 
	   not protected from high reference counts supplied by an attacker, 
	   potentially allowing remote compromise of the server. [5]


REFERENCES:

	[1] PHP 4.4.6 Release Announcement
	    http://www.php.net/releases/4_4_6.php

	[2] MOPB-01-2007 PHP 4 Userland ZVAL Reference Counter Overflow
	    http://www.php-security.org/MOPB/MOPB-01-2007.html

	[3] MOPB-02-2007 PHP Executor Deep Recursion Stack Overflow
	    http://www.php-security.org/MOPB/MOPB-02-2007.html

	[4] MOPB-03-2007 PHP Variable Destructor Recursion Overflow
	    http://www.php-security.org/MOPB/MOPB-03-2007.html

	[5] MOPB-04-2007 PHP 4 unserialize() ZVAL Reference Counter Overflow
	    http://www.php-security.org/MOPB/MOPB-04-2007.html


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRefPnyh9+71yA2DNAQK8igP+LLI5XhZjlXM1GLzeDBka4/DHZbn4JMBl
iVAs6FO978m30dHuVpia54Q5Iuud+W28/CT5T79x5P0E+z/9bk8cCdz6DJKSDC51
bSBHpNvvJOW1ijYImXUhoBlfzBLbb0S+bLkPLpM/C96zRQVteIpA2HgTQpsug5WB
Ltlr4Kj4Y7M=
=03sK
-----END PGP SIGNATURE-----