CVE-2011-0708: Input Validation

First published: Mon Feb 28 2011(Updated: )

An insufficient input validation flaws was discovered in the PHP's Exif extension that allows extracting Exif data from image files: <a href="http://thread.gmane.org/gmane.comp.security.oss.general/4198">http://thread.gmane.org/gmane.comp.security.oss.general/4198</a> An integer overflow causes PHP to not validate offsets read from the file properly, causing it to read behind the end of the buffer. This leads to PHP interpreter crash when reading specially crafted Exif data. Before the code over-reading the buffer is reached, PHP needs to allocate a large amount of memory (based on the components / length value read from the file). This attempt triggers the integer overflow check in safe_emalloc on 32bit platforms and requires the memory_limit for the script to be set to -1 (i.e. no limit is enforced by PHP) on 64bit platforms. Upstream commits, which include reproducers: <a href="http://svn.php.net/viewvc?view=revision&revision=308316">http://svn.php.net/viewvc?view=revision&revision=308316</a> <a href="http://svn.php.net/viewvc?view=revision&revision=308317">http://svn.php.net/viewvc?view=revision&revision=308317</a> The follow-up commit replaces the use of hard-coded numeric constant with INT32_MAX: <a href="http://svn.php.net/viewvc?view=revision&revision=308362">http://svn.php.net/viewvc?view=revision&revision=308362</a> This fix should first appear in upstream version 5.3.6.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
PHP PHP	<=5.3.5
PHP PHP	=1.0
PHP PHP	=2.0
PHP PHP	=2.0b10
PHP PHP	=3.0
PHP PHP	=3.0.1
PHP PHP	=3.0.2
PHP PHP	=3.0.3
PHP PHP	=3.0.4
PHP PHP	=3.0.5
PHP PHP	=3.0.6
PHP PHP	=3.0.7
PHP PHP	=3.0.8
PHP PHP	=3.0.9
PHP PHP	=3.0.10
PHP PHP	=3.0.11
PHP PHP	=3.0.12
PHP PHP	=3.0.13
PHP PHP	=3.0.14
PHP PHP	=3.0.15
PHP PHP	=3.0.16
PHP PHP	=3.0.17
PHP PHP	=3.0.18
PHP PHP	=4.0
PHP PHP	=4.0-beta_4_patch1
PHP PHP	=4.0-beta1
PHP PHP	=4.0-beta2
PHP PHP	=4.0-beta3
PHP PHP	=4.0-beta4
PHP PHP	=4.0.0
PHP PHP	=4.0.1
PHP PHP	=4.0.2
PHP PHP	=4.0.3
PHP PHP	=4.0.4
PHP PHP	=4.0.5
PHP PHP	=4.0.6
PHP PHP	=4.0.7
PHP PHP	=4.1.0
PHP PHP	=4.1.1
PHP PHP	=4.1.2
PHP PHP	=4.2.0
PHP PHP	=4.2.1
PHP PHP	=4.2.2
PHP PHP	=4.2.3
PHP PHP	=4.3.0
PHP PHP	=4.3.1
PHP PHP	=4.3.2
PHP PHP	=4.3.3
PHP PHP	=4.3.4
PHP PHP	=4.3.5
PHP PHP	=4.3.6
PHP PHP	=4.3.7
PHP PHP	=4.3.8
PHP PHP	=4.3.9
PHP PHP	=4.3.10
PHP PHP	=4.3.11
PHP PHP	=4.4.0
PHP PHP	=4.4.1
PHP PHP	=4.4.2
PHP PHP	=4.4.3
PHP PHP	=4.4.4
PHP PHP	=4.4.5
PHP PHP	=4.4.6
PHP PHP	=4.4.7
PHP PHP	=4.4.8
PHP PHP	=4.4.9
PHP PHP	=5.0.0
PHP PHP	=5.0.0-beta1
PHP PHP	=5.0.0-beta2
PHP PHP	=5.0.0-beta3
PHP PHP	=5.0.0-beta4
PHP PHP	=5.0.0-rc1
PHP PHP	=5.0.0-rc2
PHP PHP	=5.0.0-rc3
PHP PHP	=5.0.1
PHP PHP	=5.0.2
PHP PHP	=5.0.3
PHP PHP	=5.0.4
PHP PHP	=5.0.5
PHP PHP	=5.1.0
PHP PHP	=5.1.1
PHP PHP	=5.1.2
PHP PHP	=5.1.3
PHP PHP	=5.1.4
PHP PHP	=5.1.5
PHP PHP	=5.1.6
PHP PHP	=5.2.0
PHP PHP	=5.2.1
PHP PHP	=5.2.2
PHP PHP	=5.2.3
PHP PHP	=5.2.4
PHP PHP	=5.2.4
PHP PHP	=5.2.5
PHP PHP	=5.2.6
PHP PHP	=5.2.7
PHP PHP	=5.2.8
PHP PHP	=5.2.9
PHP PHP	=5.2.10
PHP PHP	=5.2.11
PHP PHP	=5.2.12
PHP PHP	=5.2.13
PHP PHP	=5.2.14
PHP PHP	=5.2.15
PHP PHP	=5.2.16
PHP PHP	=5.2.17
PHP PHP	=5.3.0
PHP PHP	=5.3.1
PHP PHP	=5.3.2
PHP PHP	=5.3.3
PHP PHP	=5.3.4

CVE-2011-0708: Input Validation

Remedy

Remedy

Remedy

Never miss a vulnerability like this again

Reference Links

Company

Resources

Contact