Quick PHP patch beats slow research reveal

Simple solution to remote code execution

7 Reg comments Got Tips?

Patches have been flung out to cover vulnerabilities in PHP that led to remote code execution and buffer overflows.

The flaws were detailed this week by Swiss researchers High-Tech Bridge in versions 5.4.33, 5.5.17 and 5.6.1 on a machine running Ubuntu 14.04.1 LTS and the Radamsa fuzzer.

A patch issued last month for CVE-2014-3669 closed an unserialised function which researcher Symeon Paraschoudis detailed in a technical walk through.

"As expected *p pointer (stored in edx) now points to invalid memory address and continuing the execution we are going to dereference this address and eventually crash," Paraschoudis said in the post.

"To sum up this is a read access violation and probably not exploitable, but cases like CVE-2013-7226 (a second overflow) can lead to a heap-based buffer overflow and probably allow potential attackers to gain remote code execution."

PHP developer Stanislav Malyshev dropped a patch days after the bug release preventing the crash, including those for two other PHP issues (CVEs 204-3668 and 2014-2670). ®

SUBSCRIBE TO OUR WEEKLY TECH NEWSLETTER


Biting the hand that feeds IT © 1998–2020