Time-of-check Time-of-use (TOCTOU) Race Condition in PHP

1) Time-of-check Time-of-use (TOCTOU) Race Condition

EUVDB-ID: #VU110522

Risk: Medium

CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2004-0594

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PHP: 5.0.0

CPE2.3

• cpe:2.3:a:php_group:php:5.0.0:*:*:*:*:*:*:*

External links

https://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023908.html
https://www.debian.org/security/2004/dsa-531
https://www.debian.org/security/2005/dsa-669
https://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:068
https://www.redhat.com/support/errata/RHSA-2004-392.html
https://www.redhat.com/support/errata/RHSA-2004-395.html
https://www.redhat.com/support/errata/RHSA-2004-405.html
https://www.novell.com/linux/security/advisories/2004_21_php4.html
https://www.trustix.org/errata/2004/0039/
https://www.gentoo.org/security/en/glsa/glsa-200407-13.xml
https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000847
https://www.redhat.com/support/errata/RHSA-2005-816.html
https://www.securityfocus.com/bid/10725
https://marc.info/?l=bugtraq&m=109051444105182&w=2
https://marc.info/?l=bugtraq&m=108981780109154&w=2
https://marc.info/?l=bugtraq&m=109181600614477&w=2
https://marc.info/?l=bugtraq&m=108982983426031&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/16693
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10896

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.