CVE-2002-0081
CVSS7.5
发布时间 :2002-03-08 00:00:00
修订时间 :2016-10-17 22:15:59
NMCO    

[原文]Buffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled.


[CNNVD]PHP Post文件上传远程缓冲区溢出漏洞(CNNVD-200203-023)

        
        PHP是一种被广泛使用的脚本语言,用于基于Web的CGI程序,它可被安装在包括Apache、IIS、 Caudium、Netscape、iPlanet和OmniHTTPd等多种Web服务器上。
        PHP 4.1.2以前的实现中存在缓冲区溢出漏洞,远程攻击者可以通过溢出攻击在主机上执行任意指令。
        PHP支持multipart/form-data POST请求(RFC1867),实现了POST文件上传。但是用于解码MIME数据的php_mime_split函数存在缓冲区溢出问题,远程攻击者可以利用这个漏洞在主机上以Web服务器进程的身份执行任意指令。不仅PHP4受这个漏洞影响,而且以前的PHP3也受此漏洞的影响,Apache的PHP模块也存在这个漏洞。
        使用cvs PHP 4.2.0-dev版本的用户不受上述安全漏洞的影响,因为4.2.0系列的文件上传代码已完全重写。
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:php:php:4.1.0PHP PHP 4.1.0
cpe:/a:php:php:4.1.1PHP PHP 4.1.1
cpe:/a:php:php:3.0PHP PHP 3.0
cpe:/a:php:php:4.0.6PHP PHP 4.0.6

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0081
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0081
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200203-023
(官方数据源) CNNVD

- 其它链接及资源

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000468
(UNKNOWN)  CONECTIVA  CLA-2002:468
http://marc.info/?l=bugtraq&m=101484705523351&w=2
(UNKNOWN)  BUGTRAQ  20020227 Advisory 012002: PHP remote vulnerabilities
http://marc.info/?l=bugtraq&m=101497256024338&w=2
(UNKNOWN)  BUGTRAQ  20020228 TSLSA-2002-0033 - mod_php
http://marc.info/?l=bugtraq&m=101537076619812&w=2
(UNKNOWN)  BUGTRAQ  20020304 Apache+php Proof of Concept Exploit
http://marc.info/?l=ntbugtraq&m=101484975231922&w=2
(UNKNOWN)  NTBUGTRAQ  20020227 PHP remote vulnerabilities
http://marc.info/?l=vuln-dev&m=101468694824998&w=2
(UNKNOWN)  VULN-DEV  20020225 Re: Rumours about Apache 1.3.22 exploits
http://online.securityfocus.com/advisories/3911
(UNKNOWN)  HP  HPSBTL0203-028
http://security.e-matters.de/advisories/012002.html
(VENDOR_ADVISORY)  MISC  http://security.e-matters.de/advisories/012002.html
http://www.cert.org/advisories/CA-2002-05.html
(UNKNOWN)  CERT  CA-2002-05
http://www.debian.org/security/2002/dsa-115
(UNKNOWN)  DEBIAN  DSA-115
http://www.iss.net/security_center/static/8281.php
(UNKNOWN)  XF  php-file-upload-overflow(8281)
http://www.kb.cert.org/vuls/id/297363
(UNKNOWN)  CERT-VN  VU#297363
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-017.php
(UNKNOWN)  MANDRAKE  MDKSA-2002:017
http://www.linuxsecurity.com/advisories/other_advisory-1924.html
(UNKNOWN)  ENGARDE  ESA-20020301-006
http://www.novell.com/linux/security/advisories/2002_007_mod_php4_txt.html
(UNKNOWN)  SUSE  SuSE-SA:2002:007
http://www.php.net/downloads.php
(PATCH)  CONFIRM  http://www.php.net/downloads.php
http://www.redhat.com/support/errata/RHSA-2002-035.html
(UNKNOWN)  REDHAT  RHSA-2002:035
http://www.redhat.com/support/errata/RHSA-2002-040.html
(UNKNOWN)  REDHAT  RHSA-2002:040
http://www.securityfocus.com/bid/4183
(UNKNOWN)  BID  4183

- 漏洞信息

PHP Post文件上传远程缓冲区溢出漏洞
高危 边界条件错误
2002-03-08 00:00:00 2005-09-14 00:00:00
远程  
        
        PHP是一种被广泛使用的脚本语言,用于基于Web的CGI程序,它可被安装在包括Apache、IIS、 Caudium、Netscape、iPlanet和OmniHTTPd等多种Web服务器上。
        PHP 4.1.2以前的实现中存在缓冲区溢出漏洞,远程攻击者可以通过溢出攻击在主机上执行任意指令。
        PHP支持multipart/form-data POST请求(RFC1867),实现了POST文件上传。但是用于解码MIME数据的php_mime_split函数存在缓冲区溢出问题,远程攻击者可以利用这个漏洞在主机上以Web服务器进程的身份执行任意指令。不仅PHP4受这个漏洞影响,而且以前的PHP3也受此漏洞的影响,Apache的PHP模块也存在这个漏洞。
        使用cvs PHP 4.2.0-dev版本的用户不受上述安全漏洞的影响,因为4.2.0系列的文件上传代码已完全重写。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 禁止PHP的文件上传功能。
         如果既无法升级也无法安装补丁,用户也可以通过禁用文件上传支持保护系统不受基于这些安全漏洞的攻击。按照下列说明编辑PHP配置文件php.ini:
         file_uploads = off
         注意本设置仅适用于4.0.3及以上版本。不过这样你将无法使用文件上传,这在您的环境中可能是无法接受的。
        厂商补丁:
        Debian
        ------
        Debian已经为此发布了一个安全公告(DSA-115-1)以及相应补丁:
        DSA-115-1:php3, php4 broken boundary check and more
        链接:
        http://www.debian.org/security/2002/dsa-115

        补丁下载:
        Source archives:
        
        http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18-0potato1.1.diff.gz

         MD5 checksum: 58b7cb40350bb445760a5d38ad01cfaf
        
        http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18-0potato1.1.dsc

         MD5 checksum: 480295e5782c2ca72d7f2df3e4a19f57
        
        http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18.orig.tar.gz

         MD5 checksum: da541ac71d951c47a011ceb26664ba2d
        
        http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1-0potato3.diff.gz

         MD5 checksum: 57eb1215ae2230134845800aaa6be8dd
        
        http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1-0potato3.dsc

         MD5 checksum: caad999df0a24b07ecc9c98ff02a9260
        
        http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1.orig.tar.gz

         MD5 checksum: e65b706a7fc4469d1ccd564ef8a2c534
         Architecture independent components:
        
        http://security.debian.org/dists/stable/updates/main/binary-all/php3-doc_3.0.18-0potato1.1_all.deb

         MD5 checksum: b3d80c7c4d88868baae39131d07190d9
        
        http://security.debian.org/dists/stable/updates/main/binary-all/php4-dev_4.0.3pl1-0potato3_all.deb

         MD5 checksum: 1d91f4365fe2ec5fbed5c3a26a852e1c
         Alpha architecture:
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-gd_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: c5648dc6802c11132a64b6de62e88952
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-imap_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: a001b65cbcbdc25900306a0aac465c2d
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-ldap_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: 8d06ff903636edd03cae2bc9fbf049c4
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-magick_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: 6af2006e5d223306eff0702311caa266
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-mhash_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: 31a37117d9e2475d1c657d54fe91b97d
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-mysql_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: 3e08b5a7c3dc413e262de6ea3f93f387
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-pgsql_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: 9763d7699d35867880a78668595aab41
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-snmp_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: b9f8bd5d7bf264def15cb2a1fc040bff
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-xml_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: e100daab25752a1ffb57722aba643217
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: f213a0d5441c50f5d14c706cba7c99b9
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-dev_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: b2691dde933907b9a760a3c62d928b87
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-gd_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: e0a18a27b5a7488093f43beeecaee313
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-imap_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: 362a93f221ca518be131f907ec01f772
        
        http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-ldap_3.0.18-0potato1.1_alpha.deb

         MD5 checksum: fe1b52db95e01faa91e1977bc984462f
        

- 漏洞信息

34719
PHP php3_mime_split Function POST Request Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

A remote overflow exists in php. The php3_mime_split function fails to perform proper bounds checking resulting in a heap overflow. By using the HTTP POST method to upload a PHP form containing specially crafted MIME-encoded data, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

- 时间线

2002-02-27 Unknow
2002-03-04 Unknow

- 解决方案

Upgrade to version 4.1.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站