CVE-2011-0708: Input Validation

Q: What is the severity of CVE-2011-0708?

CVE-2011-0708 is classified as a medium severity vulnerability that stems from insufficient input validation in the PHP Exif extension.

Q: How do I fix CVE-2011-0708?

To mitigate CVE-2011-0708, users should upgrade their PHP installation to a version that has resolved this vulnerability.

Q: What versions of PHP are affected by CVE-2011-0708?

CVE-2011-0708 affects multiple PHP versions including 3.0, 4.0 to 4.4.9, and 5.0 to 5.3.5.

Q: Is CVE-2011-0708 an aggregate of vulnerabilities?

No, CVE-2011-0708 is specifically tied to an integer overflow vulnerability within the Exif extension of PHP.

Q: Can CVE-2011-0708 lead to other security issues?

Yes, the exploitation of CVE-2011-0708 can potentially lead to user-controlled buffer overflows and arbitrary code execution.

Published Feb 28, 2011

Updated

An insufficient input validation flaws was discovered in the PHP's Exif extension that allows extracting Exif data from image files: http://thread.gmane.org/gmane.comp.security.oss.general/4198

An integer overflow causes PHP to not validate offsets read from the file properly, causing it to read behind the end of the buffer. This leads to PHP interpreter crash when reading specially crafted Exif data.

Before the code over-reading the buffer is reached, PHP needs to allocate a large amount of memory (based on the components / length value read from the file). This attempt triggers the integer overflow check in safeemalloc on 32bit platforms and requires the memorylimit for the script to be set to -1 (i.e. no limit is enforced by PHP) on 64bit platforms.

Upstream commits, which include reproducers: http://svn.php.net/viewvc?view=revision&revision=308316 http://svn.php.net/viewvc?view=revision&revision=308317

The follow-up commit replaces the use of hard-coded numeric constant with INT32MAX: http://svn.php.net/viewvc?view=revision&revision=308362

This fix should first appear in upstream version 5.3.6.

Other sources

exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.

— MITRE

Affected Software

110 affected components

PHP PHP=4.3.9

PHP PHP=4.4.9

PHP PHP=3.0

PHP PHP=5.2.9

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.2.4

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=5.3.1

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=5.2.14

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=5.2.16

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=5.2.12

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.2.17

PHP PHP=5.3.0

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.3.3

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.4.5

PHP PHP=5.2.13

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=2.0b10

PHP PHP=4.4.8

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=5.3.2

PHP PHP<=5.3.5

PHP PHP=5.3.4

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=5.2.10

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=5.0.2

PHP PHP=4.4.6

PHP PHP=3.0.12

PHP PHP=5.2.15

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=5.2.1

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

PHP PHP=5.2.8

PHP PHP=4.4.7

Remediation

Event History

Feb 28, 2011

Data Sourced

04:51 PM

DescriptionSeverityAffected Software

Mar 20, 2011

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-0708?

CVE-2011-0708 is classified as a medium severity vulnerability that stems from insufficient input validation in the PHP Exif extension.

How do I fix CVE-2011-0708?

To mitigate CVE-2011-0708, users should upgrade their PHP installation to a version that has resolved this vulnerability.

What versions of PHP are affected by CVE-2011-0708?

CVE-2011-0708 affects multiple PHP versions including 3.0, 4.0 to 4.4.9, and 5.0 to 5.3.5.

Is CVE-2011-0708 an aggregate of vulnerabilities?

No, CVE-2011-0708 is specifically tied to an integer overflow vulnerability within the Exif extension of PHP.

Can CVE-2011-0708 lead to other security issues?

Yes, the exploitation of CVE-2011-0708 can potentially lead to user-controlled buffer overflows and arbitrary code execution.

CVE-2011-0708: Input Validation

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2011-0708?

How do I fix CVE-2011-0708?

What versions of PHP are affected by CVE-2011-0708?

Is CVE-2011-0708 an aggregate of vulnerabilities?

Can CVE-2011-0708 lead to other security issues?

Company

Resources

Contact