REDHAT-BUG-823464
First published: Mon May 21 2012(Updated: )
A security flaw was found in the way the com_print_typeinfo() routine of the PHP scripting language processed certain COM object arguments. If a PHP language based application remotely accepted untrusted com_print_typeinfo() arguments in order to print out a PHP class definition for a dispatchable interface, a remote attacker could provide a specially-crafted COM object, which once processed by the application could lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application. References: [1] <a href="https://isc.sans.edu/diary/PHP+5+4+Remote+Exploit+PoC+in+the+wild/13255">https://isc.sans.edu/diary/PHP+5+4+Remote+Exploit+PoC+in+the+wild/13255</a> [2] <a href="http://packetstormsecurity.org/files/112851/php54-exec.txt">http://packetstormsecurity.org/files/112851/php54-exec.txt</a> [3] <a href="http://www.exploit-db.com/exploits/18861/">http://www.exploit-db.com/exploits/18861/</a> [4] <a href="http://www.reddit.com/r/netsec/comments/tuyp3/isc_diary_php_54_remote_exploit_poc_in_the_wild/">http://www.reddit.com/r/netsec/comments/tuyp3/isc_diary_php_54_remote_exploit_poc_in_the_wild/</a> CVE request: [5] <a href="http://www.openwall.com/lists/oss-security/2012/05/20/1">http://www.openwall.com/lists/oss-security/2012/05/20/1</a> CVE assignment: [6] <a href="http://www.openwall.com/lists/oss-security/2012/05/20/2">http://www.openwall.com/lists/oss-security/2012/05/20/2</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP | =5.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://isc.sans.edu/diary/PHP+5+4+Remote+Exploit+PoC+in+the+wild/13255
- http://packetstormsecurity.org/files/112851/php54-exec.txt
- http://www.exploit-db.com/exploits/18861/
- http://www.reddit.com/r/netsec/comments/tuyp3/isc_diary_php_54_remote_exploit_poc_in_the_wild/
- http://www.openwall.com/lists/oss-security/2012/05/20/1
- http://www.openwall.com/lists/oss-security/2012/05/20/2
- https://bugzilla.redhat.com/show_bug.cgi?id=823464
Frequently Asked Questions
What is the severity of REDHAT-BUG-823464?
REDHAT-BUG-823464 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix REDHAT-BUG-823464?
To fix REDHAT-BUG-823464, update PHP to version 5.4.1 or later, as this version includes patches for the vulnerability.
What applications are affected by REDHAT-BUG-823464?
REDHAT-BUG-823464 affects PHP version 5.4 when it processes untrusted COM object arguments.
Can REDHAT-BUG-823464 be exploited remotely?
Yes, REDHAT-BUG-823464 allows attackers to exploit the vulnerability remotely if untrusted arguments are passed to the PHP com_print_typeinfo() function.
What is the function vulnerable in REDHAT-BUG-823464?
The vulnerability in REDHAT-BUG-823464 exists in the com_print_typeinfo() routine of the PHP scripting language.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-2376
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/php
- canonical/php