ID CVE-2004-1018
Summary Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
References
Vulnerable Configurations
CVSS
Base: 10.0 (as of 01-01-2004 - 00:00)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
exploit-db via4
  • description PHP 3/4/5 Multiple Local And Remote Vulnerabilities (1). CVE-2004-1018. Dos exploit for php platform
    id EDB-ID:24854
    last seen 2016-02-03
    modified 2004-12-15
    published 2004-12-15
    reporter Stefan Esser
    source https://www.exploit-db.com/download/24854/
    title PHP 3/4/5 - Multiple Local And Remote Vulnerabilities 1
  • description PHP 3/4/5 Multiple Local And Remote Vulnerabilities (2). CVE-2004-1018. Dos exploit for php platform
    id EDB-ID:24855
    last seen 2016-02-03
    modified 2004-12-15
    published 2004-12-15
    reporter Slythers
    source https://www.exploit-db.com/download/24855/
    title PHP 3/4/5 - Multiple Local And Remote Vulnerabilities 2
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-99-1.NASL
    description Stefano Di Paola discovered integer overflows in PHP's pack() and unpack() functions. A malicious PHP script could exploit these to break out of safe mode and execute arbitrary code with the privileges of the PHP interpreter. (CAN-2004-1018) Note: The second part of CAN-2004-1018 (buffer overflow in the shmop_write() function) was already fixed in USN-66-1. Stefan Esser discovered two safe mode bypasses which allowed malicious PHP scripts to circumvent path restrictions. This was possible by either using virtual_popen() with a current directory containing shell metacharacters (CAN-2004-1063) or creating a specially crafted directory whose length exceeded the capacity of the realpath() function (CAN-2004-1064). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-25
    plugin id 20725
    published 2006-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=20725
    title Ubuntu 4.10 : php4 vulnerabilities (USN-99-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2004-687.NASL
    description Updated php packages that fix various security issues and bugs are now available for Red Hat Enterprise Linux 3. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. Flaws including possible information disclosure, double free, and negative reference index array underflow were found in the deserialization code of PHP. PHP applications may use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1019 to this issue. A flaw in the exif extension of PHP was found which lead to a stack overflow. An attacker could create a carefully crafted image file in such a way that if parsed by a PHP script using the exif extension it could cause a crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1065 to this issue. An information disclosure bug was discovered in the parsing of 'GPC' variables in PHP (query strings or cookies, and POST form data). If particular scripts used the values of the GPC variables, portions of the memory space of an httpd child process could be revealed to the client. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0958 to this issue. A file access bug was discovered in the parsing of 'multipart/form-data' forms, used by PHP scripts which allow file uploads. In particular configurations, some scripts could allow a malicious client to upload files to an arbitrary directory where the 'apache' user has write access. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0959 to this issue. Flaws were found in shmop_write, pack, and unpack PHP functions. These functions are not normally passed user-supplied data, so would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1018 to this issue. Various issues were discovered in the use of the 'select' system call in PHP, which could be triggered if PHP is used in an Apache configuration where the number of open files (such as virtual host log files) exceeds the default process limit of 1024. Workarounds are now included for some of these issues. The 'phpize' shell script included in PHP can be used to build third-party extension modules. A build issue was discovered in the 'phpize' script on some 64-bit platforms which prevented correct operation. The 'pcntl' extension module is now enabled in the command line PHP interpreter, /usr/bin/php. This module enables process control features such as 'fork' and 'kill' from PHP scripts. Users of PHP should upgrade to these updated packages, which contain fixes for these issues.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 16041
    published 2004-12-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=16041
    title RHEL 3 : php (RHSA-2004:687)
  • NASL family CGI abuses
    NASL id PHP45_MULTIPLE_FLAWS.NASL
    description According to its banner, the version of PHP installed on the remote host is prior to 4.3.10 / 5.0.3. It is, therefore, affected by multiple security issues that could, under certain circumstances, allow an attacker to execute arbitrary code on the remote host, provided that the attacker can pass arbitrary data to some functions, or to bypass safe_mode.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 15973
    published 2004-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15973
    title PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2005-032.NASL
    description Updated php packages that fix various security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. Flaws including possible information disclosure, double free, and negative reference index array underflow were found in the deserialization code of PHP. PHP applications may use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1019 to this issue. A flaw in the exif extension of PHP was found which lead to a stack overflow. An attacker could create a carefully crafted image file in such a way which, if parsed by a PHP script using the exif extension, could cause a crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1065 to this issue. Flaws were found in shmop_write, pack, and unpack PHP functions. These functions are not normally passed user-supplied data, so would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1018 to this issue. Users of PHP should upgrade to these updated packages, which contain fixes for these issues.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 17166
    published 2005-02-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=17166
    title RHEL 4 : php (RHSA-2005:032)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2005-001.NASL
    description he remote host is missing Security Update 2005-001. This security update contains a number of fixes for the following programs : - at commands - ColorSync - libxml2 - Mail - PHP - Safari - SquirrelMail These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 16251
    published 2005-01-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=16251
    title Mac OS X Multiple Vulnerabilities (Security Update 2005-001)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2005-031.NASL
    description Updated php packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A double-free bug was found in the deserialization code of PHP. PHP applications use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1019 to this issue. Flaws were found in the pack and unpack PHP functions. These functions do not normally pass user-supplied data, so they would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1018 to this issue. A bug was discovered in the initialization of the OpenSSL library, such that the curl extension could not be used to perform HTTP requests over SSL unless the php-imap package was installed. Users of PHP should upgrade to these updated packages, which contain fixes for these issues.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 16222
    published 2005-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=16222
    title RHEL 2.1 : php (RHSA-2005:031)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2005-072.NASL
    description A number of vulnerabilities are addressed in this PHP update : Stefano Di Paolo discovered integer overflows in PHP's pack(), unpack(), and shmop_write() functions which could allow a malicious script to break out of safe mode and execute arbitrary code with privileges of the PHP interpreter (CVE-2004-1018; this was previously fixed in Mandrakelinux >= 10.0 in MDKSA-2004:151). Stefan Esser discovered two safe mode bypasses which would allow malicious scripts to circumvent path restrictions by using virtual_popen() with a current directory containing shell meta- characters (CVE-2004-1063) or by creating a specially crafted directory whose length exceeded the capacity of realpath() (CVE-2004-1064; both of these were previously fixed in Mandrakelinux >= 10.0 in MDKSA-2004:151). Two Denial of Service vulnerabilities were found in the getimagesize() function which uses the format-specific internal functions php_handle_iff() and php_handle_jpeg() which would get stuck in infinite loops when certain (invalid) size parameters are read from the image (CVE-2005-0524 and CVE-2005-0525). An integer overflow was discovered in the exif_process_IFD_TAG() function in PHP's EXIF module. EXIF tags with a specially crafted 'Image File Directory' (IFD) tag would cause a buffer overflow which could be exploited to execute arbitrary code with the privileges of the PHP server (CVE-2005-1042). Another vulnerability in the EXIF module was also discovered where headers with a large IFD nesting level would cause an unbound recursion which would eventually overflow the stack and cause the executed program to crash (CVE-2004-1043). All of these issues are addressed in the Corporate Server 2.1 packages and the last three issues for all other platforms, which had previously included the first two issues but had not been mentioned in MDKSA-2004:151.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 18091
    published 2005-04-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=18091
    title Mandrake Linux Security Advisory : php (MDKSA-2005:072)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2004-151.NASL
    description A number of vulnerabilities in PHP versions prior to 4.3.10 were discovered by Stefan Esser. Some of these vulnerabilities were not deemed to be severe enough to warrant CVE names, however the packages provided, with the exception of the Corporate Server 2.1 packages, include fixes for all of the vulnerabilities, thanks to the efforts of the OpenPKG team who extracted and backported the fixes. The vulnerabilities fixed in all provided packages include a fix for a possible information disclosure, double free, and negative reference index array underflow in deserialization code (CVE-2004-1019). As well, the exif_read_data() function suffers from an overflow on a long sectionname; this vulnerability was discovered by Ilia Alshanetsky (CVE-2004-1065). The other fixes that appear in Mandrakelinux 9.2 and newer packages include a fix for out of bounds memory write access in shmop_write() and integer overflow/underflows in the pack() and unpack() functions. The addslashes() function did not properly escape '�' correctly. A directory bypass issue existed in safe_mode execution. There is an issue of arbitrary file access through path truncation. Finally, the 'magic_quotes_gpc' functionality could lead to one level directory traversal with file uploads.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 15998
    published 2004-12-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15998
    title Mandrake Linux Security Advisory : php (MDKSA-2004:151)
oval via4
accepted 2013-04-29T04:10:12.307-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
family unix
id oval:org.mitre.oval:def:10949
status accepted
submitted 2010-07-09T03:56:16-04:00
title Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
version 24
redhat via4
advisories
  • rhsa
    id RHSA-2005:032
  • rhsa
    id RHSA-2005:816
refmap via4
bid 12045
bugtraq
  • 20041215 Advisory 01/2004: Multiple vulnerabilities in PHP 4/5
  • 20041219 PHP shmop.c module permits write of arbitrary memory.
confirm http://www.php.net/release_4_3_10.php
fedora FLSA:2344
hp HPSBMA01212
mandrake
  • MDKSA-2004:151
  • MDKSA-2005:072
misc http://www.hardened-php.net/advisories/012004.txt
osvdb 12411
ubuntu USN-99-1
xf php-shmopwrite-outofbounds-memory(18515)
Last major update 07-12-2016 - 21:59
Published 10-01-2005 - 00:00
Last modified 10-10-2017 - 21:29
Back to Top