Main Vulnerability Database Vulnerabilities #VU16092

Type Confusion in PHP - CVE-2014-3515

Published: November 27, 2018 / Updated: June 17, 2021

Vulnerability identifier: #VU16092

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-3515

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in (1) ArrayObject and (2) SPLObjectStorage. when the SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization. A remote attacker can trigger a type confusion error via a crafted string that triggers use of a Hashtable destructor and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

PHP
Amazon Linux AMI
Slackware Linux
php5 (Ubuntu package)
HP-UX Web Server Suite

How to mitigate CVE-2014-3515

Install update from vendor's website.

PHP - addressed in versions 5.4.30, 5.5.14
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.26, 5.3.10-1ubuntu3.13
HP-UX Web Server Suite - update to 4.02

Links to Public Exploits and PoC-codes

Exploit #6439 - Kerio Control Unified Threat Management 9.1.0 build 1087 / 9.1.1 build 1324 - Multiple Vulnerabilities (June 17, 2021)

External References

https://bugs.php.net/bug.php?id=67492