This vulnerability exists in the PHP Apache SPI POST parsing code:
code
PHP signed comparison vulnerability example
/* {{{ sapi_apache_read_post
*/
static int sapi_apache_read_post(char *buffer,
uint count_bytes TSRMLS_DC)
{
uint total_read_bytes=0, read_bytes;
request_rec *r = (request_rec *) SG(server_context);
void (*handler)(int);
/*
* This handles the situation where the browser sends a Expect:
* 100-continue header
* and needs to recieve confirmation from the server on whether
* or not it can send
* the rest of the request. RFC 2616
*
*/
if (!SG(read_post_bytes) && !ap_should_client_block(r)) {
return total_read_bytes;
}
handler = signal(SIGPIPE, SIG_IGN);
while (total_read_bytes<count_bytes) {
/* start timeout timer */
hard_timeout("Read POST information", r);
read_bytes = get_client_block(r, buffer+total_read_bytes,
count_bytes-total_read_bytes);
reset_timeout(r);
if (read_bytes<=0) {
break;
}
total_read_bytes += read_bytes;
}
signal(SIGPIPE, handler);
return total_read_bytes;
}
/code
It is possible to make read_bytes negative and not trigger the conditional statement 'if (read_bytes<=0)'. This is possible because read_bytes is an unsigned integer.... as get_client_block can be made to return
a negative value. Correct exploitation of this vulnerability can result in the execution of arbitrary code, BanSec Industries has sucessfully constructed
an exploit for this vulnerability, and as such are offering it for $20,000 USD.
We have already provided the blackhats with a working exploit however we've also provided them with our new BanKit, a kernel mode linux rootkit, so you won't notice you've been hacked.
Have a nice day,
Bob
BanCert, CISSP
(PHP Devs suck at spelling, by the way.)
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
