Heap-based buffer underflow in PHP - CVE-2012-2688

Vulnerability identifier: #VU4197

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2012-2688

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS conditions or execute arbitrary code on the target system.

The weakness exists due to heap-based buffer underflow in the PHP scandir() function. A remote attacker can create specially crafted files, upload them to a directory the scandir() function runs on and cause the PHP interpreter to crash or execute arbitrary code with privileges of the web server.

Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

PHP

Gentoo Linux
Amazon Linux AMI
SUSE Linux
Slackware Linux
php (Alpine package)

Update to version 5.3.15 or 5.4.5 or later.

php (Alpine package) - addressed in versions 5.3.15-r0, 5.3.15-r1

• http://www.php.net/ChangeLog-5.php

• Remote code execution in PHP
• Slackware Linux update for php
• Amazon Linux AMI update for php
• Heap-based buffer underflow in php (Alpine package)
• SUSE Linux update for php5
• SUSE Linux update for PHP5
• Gentoo update for PHP