From mordred@s-mail.com Wed Apr 2 20:37:40 2003 From: Sir Mordred To: bugtraq@securityfocus.com Date: Tue, 01 Apr 2003 10:54:43 +0000 Subject: @(#)Mordred Labs advisory - Integer overflow in PHP array_pad() function [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] //@(#) Mordred Security Labs advisory Release date: April 1, 2003 Name: Integer overflow in PHP array_pad() function Versions affected: all versions Risk: average Author: Sir Mordred (mordred@s-mail.com) I. Description: PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Please visit http://www.php.net for more information about PHP. II. Details: The function array_pad(array input, int pad_size, mixed pad_value) returns a copy of the input padded to size specified by pad_size with pad_value. Unfortunately the implementation of this function suffers from an integer overflow caused by a very long second argument and could allow a local/remote attacker in the worst case to gain control over the web server. The following short script will cause a httpd child to die: $ cat t.php III. Platforms tested Linux 2.4 with Apache 1.3.27 / PHP 4.3.1 IV. Vendor response Vendor has been contacted. ________________________________________________________________________ This letter has been delivered unencrypted. We'd like to remind you that the full protection of e-mail correspondence is provided by S-mail encryption mechanisms if only both, Sender and Recipient use S-mail. Register at S-mail.com: http://www.s-mail.com