Inaccurate Reports Concerning PHP Vulnerabilities

["mattmurphy () kc rr com" <mattmurphy () kc rr com>]

There have been a number of reports circulating about possible
vulnerabilities in PHP.  I'm going to address them one-by-one:

* Integer Overflow in socket_iovec_alloc()

WRONG!  This is a Null-pointer de-reference:

EAX = 00000000
EDI = 41414141

0085353A 8B 38                mov         edi,dword ptr [eax]

The access violation occurs in a read error.  This is not exploitable to
gain control of the PHP interpreter, nor is it an integer overflow of any
kind.  It is simply a null-read, and the lone register controlled by user
data is obliterated by that instruction if the call succeeds.

* Buffer overflow in openlog()

I've tried passing long parameters (and large integers) to openlog().  No
crashes could be caused by this "exploit".  I was unable to demonstrate any
disruption to PHP via this "vulnerability", let alone complete control. 
Unless the vendor or the original reporter will confirm this with code
(which was, oddly enough, MISSING from the original advisory), I don't
believe this "flaw" (if it exists) can do any damage to a default
production system.

* Integer overflow in emalloc()

Funny -- there is not an emalloc() function (nor malloc, calloc, etc.)
because ALL memory allocation is handled by the interpreter itself. 
Therefore, this report is completely bogus.

--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .