PHP 5.2.x Remote Code Execution Vulnerability

[Worawit Wang <worawita () gmail com>]

Release Date: 17 February 2012
Affected Versions: 5.2.0 - 5.2.17 (unsupported version)

------------------------------------------------------------------------------------------

Description:

If PHP bails out in startup stage before setting PG(modules_activated)
to 1, the filter_globals struct is not cleaned up on shutdown stage.
The subsequence request will use uncleaned value in filter_globals
struct. With special crafted request, this problem can lead to
information disclosure and remote code execution.

Only apache modules SAPI are found to vulnerable to this problem.
While other SAPIs are safe because a PHP process exits when PHP bails
out before setting PG(modules_activated) to 1.

This bug was fixed before releasing 5.3.0.
http://svn.php.net/viewvc?view=revision&revision=279522. But the patch
is not backported to 5.2 version as described in
https://bugs.php.net/bug.php?id=47930.

------------------------------------------------------------------------------------------

Solution:

Upgrade to 5.3

------------------------------------------------------------------------------------------

Workaround:

If you still need to use PHP 5.2.x, I recommend to use cgi SAPI.

If you still need to use PHP 5.2.x as apache module, installing
Suhosin patch AND extension should help you.
Just only Suhosin patch, it still seems exploitable but much more difficult.

------------------------------------------------------------------------------------------

Vendor Response:

The final release of PHP 5.2 was in January 2011. We are not planning
any further releases.


Worawit Wangwarunyoo