CVE-2011-1092: Integer Overflow

Q: What is the severity of CVE-2011-1092?

CVE-2011-1092 has a severity rating that indicates a potential for denial of service and possible memory exposure.

Q: How do I fix CVE-2011-1092?

To fix CVE-2011-1092, you should upgrade to PHP versions 5.3.6 or later that address this vulnerability.

Q: What versions of PHP are affected by CVE-2011-1092?

CVE-2011-1092 affects multiple versions of PHP, including 4.x and 5.2.x versions prior to 5.3.6.

Q: What is the impact of exploiting CVE-2011-1092?

Exploiting CVE-2011-1092 can lead to a denial of service by crashing the application, potentially making sensitive data accessible.

Q: Can CVE-2011-1092 be exploited remotely?

Yes, CVE-2011-1092 can be exploited by context-dependent attackers, which may allow for remote exploitation under certain circumstances.

Published Mar 8, 2011

Updated

Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmopread function.

Other sources

It was reported [1],[2] that there was an integer overflow in PHP's shmopread() function. This function reads a given number of bytes from memory, at a given offset starting from a shared memory area. With a sufficiently large value, more memory is allocated than there is space for, which could result in a segfault because PHP is reading past its own memory. If there is enough allocated memory available, however, PHP could leak up to 2GB of arbitrary memory.

To test:

<?php $shmkey = ftok(FILE, 't'); $shmid = shmopopen($shmkey, "c", 0644, 100); $shmdata = shmopread($shmid, 1, 2147483647); //if there is no segmentation fault past this point, we have 2gb of memory! echo $shmdata; ?>

This sets a start value of 1, and 2^31 (2147483647) as the count:

2147483647+1 = -2147483647

This was corrected upstream [3] for version 5.3.6.

References:

[1] http://openwall.com/lists/oss-security/2011/03/08/9 [2] http://bugs.php.net/54193 [3] http://svn.php.net/viewvc/?view=revision&revision=309018

— Red Hat

Affected Software

110 affected components

PHP PHP=4.3.9

PHP PHP=4.4.9

PHP PHP=3.0

PHP PHP=5.2.9

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.2.4

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=5.3.1

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=5.2.14

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=5.2.16

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=5.2.12

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.2.17

PHP PHP=5.3.0

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.3.3

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.4.5

PHP PHP=5.2.13

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=2.0b10

PHP PHP=4.4.8

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=5.3.2

PHP PHP<=5.3.5

PHP PHP=5.3.4

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=5.2.10

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=5.0.2

PHP PHP=4.4.6

PHP PHP=3.0.12

PHP PHP=5.2.15

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=5.2.1

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

PHP PHP=5.2.8

PHP PHP=4.4.7

Remediation

Event History

Mar 8, 2011

CVE Published

12:00 AM

Data Sourced

12:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via Red Hat·07:05 PM

DescriptionSeverityAffected Software

Mar 15, 2011

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-1092?

CVE-2011-1092 has a severity rating that indicates a potential for denial of service and possible memory exposure.

How do I fix CVE-2011-1092?

To fix CVE-2011-1092, you should upgrade to PHP versions 5.3.6 or later that address this vulnerability.

What versions of PHP are affected by CVE-2011-1092?

CVE-2011-1092 affects multiple versions of PHP, including 4.x and 5.2.x versions prior to 5.3.6.

What is the impact of exploiting CVE-2011-1092?

Exploiting CVE-2011-1092 can lead to a denial of service by crashing the application, potentially making sensitive data accessible.

Can CVE-2011-1092 be exploited remotely?

Yes, CVE-2011-1092 can be exploited by context-dependent attackers, which may allow for remote exploitation under certain circumstances.

CVE-2011-1092: Integer Overflow

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2011-1092?

How do I fix CVE-2011-1092?

What versions of PHP are affected by CVE-2011-1092?

What is the impact of exploiting CVE-2011-1092?

Can CVE-2011-1092 be exploited remotely?

Company

Resources

Contact