Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

PHP 5.3.10 fixes critical remote code execution vulnerability

The vulnerability was introduced by the fix for a hash collision denial-of-service flaw

The PHP Group released PHP 5.3.10 on Thursday in order to address a critical security flaw that can be exploited to execute arbitrary code on servers running an older version of the Web development platform.

The vulnerability is identified as CVE-2012-0830 and was discovered by Stefan Esser, an independent security consultant and creator of the popular Suhosin security extension for PHP.

SecurityFocus classifies the issue as a design error because it was accidentally introduced while fixing a separate denial-of-service (DoS) vulnerability in early January.

That vulnerability is known as CVE-2011-4885 and was disclosed in December 2011 at the Chaos Communication Congress by security researchers Alexander Klink and Julian Wälde.

It affects a number of Web development platforms including PHP, ASP.NET, Java and Python and can be exploited in a so-called hash collision attack. The PHP development team addressed CVE-2011-4885 in PHP 5.3.9, which was released on Jan. 10.

"The fix for the Hash Collision DoS introduced a new directive (max_input_vars) to limit the number of accepted input variables," said Carsten Eiram, chief security specialist at vulnerability research firm Secunia.

"However, due to a logic error in the "php_register_variable_ex()" function in php_variables.c certain cases are not handled correctly when the number of supplied variables is greater than the imposed limit," he explained.

This error can be exploited by attackers to remotely execute arbitrary code on a system that runs a vulnerable PHP installation. PHP 5.3.9 along with any older versions for which the hash collision DoS patch was backported, are affected, Eiram said.

Proof-of-concept code that exploits this vulnerability has already been published online, so the likelihood of attacks targeting CVE-2012-0830 are high. Web servers administrators are advised to upgrade to PHP 5.3.10 immediately.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Hewlett-Packard, HP, Microsoft, Secunia, SecurityFocus
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: Exploits / vulnerabilities, patches, security
Latest Blog Posts
Whitepapers
  • Top 5 Threat Protection Best Practices
    Small businesses are especially vulnerable to computer viruses and lost or stolen data, since they typically lack the IT resources to deal with these threats. Inadequately protected computers open the door to annoying infections, or worse, serious business disruption. Below are five simple and effective strategies to help you protect your business against an ever-increasing number of threats.
    Learn more »
  • Traditional Backup is Dead - Are you prepared?
    Conventional backup and recovery approaches clearly can't keep up with ever-growing storage rates. It's time to take on a new strategy.
    Learn more »
  • HP Security Action Plan for Enterprise Printing and Imaging
    Security is a part of how we work. When you walk through the front door of your office every morning, you probably pass a level of security. At your desk, it’s likely you log in to your computer and access files over a secure server. From security badges and ID cards to network firewalls and software security, it may seem like your organisation has taken every measure to protect its property, people and data. This action plan outlines a step-by-step approach to help you develop a plan that improves the security of your printing and imaging environment and boosts your business.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments