PHP Post文件上传远程缓冲区溢出漏洞

漏洞信息详情

PHP Post文件上传远程缓冲区溢出漏洞

• CNNVD编号：CNNVD-200203-023
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2002-0081
  
• 漏洞类型：
  
  
  边界条件错误
  
• 发布时间：
  
  2002-02-26
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-09-14
  
• 厂        商：
  
  php
• 漏洞来源：
  Stefan Esser※ se@F…

PHP是一种被广泛使用的脚本语言，用于基于Web的CGI程序，它可被安装在包括Apache、IIS、 Caudium、Netscape、iPlanet和OmniHTTPd等多种Web服务器上。
PHP 4.1.2以前的实现中存在缓冲区溢出漏洞，远程攻击者可以通过溢出攻击在主机上执行任意指令。
PHP支持multipart/form-data POST请求(RFC1867)，实现了POST文件上传。但是用于解码MIME数据的php_mime_split函数存在缓冲区溢出问题，远程攻击者可以利用这个漏洞在主机上以Web服务器进程的身份执行任意指令。不仅PHP4受这个漏洞影响，而且以前的PHP3也受此漏洞的影响，Apache的PHP模块也存在这个漏洞。
使用cvs PHP 4.2.0-dev版本的用户不受上述安全漏洞的影响，因为4.2.0系列的文件上传代码已完全重写。

临时解决方法：
如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

* 禁止PHP的文件上传功能。

如果既无法升级也无法安装补丁，用户也可以通过禁用文件上传支持保护系统不受基于这些安全漏洞的攻击。按照下列说明编辑PHP配置文件php.ini:

file_uploads = off

注意本设置仅适用于4.0.3及以上版本。不过这样你将无法使用文件上传，这在您的环境中可能是无法接受的。
厂商补丁：
Debian
——
Debian已经为此发布了一个安全公告(DSA-115-1)以及相应补丁:

DSA-115-1：php3, php4 broken boundary check and more

链接：http://www.debian.org/security/2002/dsa-115” target=”_blank”>
http://www.debian.org/security/2002/dsa-115

补丁下载：

Source archives:

http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18-0potato1.1.diff.gz” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18-0potato1.1.diff.gz

MD5 checksum: 58b7cb40350bb445760a5d38ad01cfaf

http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18-0potato1.1.dsc” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18-0potato1.1.dsc

MD5 checksum: 480295e5782c2ca72d7f2df3e4a19f57

http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18.orig.tar.gz” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/php3_3.0.18.orig.tar.gz

MD5 checksum: da541ac71d951c47a011ceb26664ba2d

http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1-0potato3.diff.gz” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1-0potato3.diff.gz

MD5 checksum: 57eb1215ae2230134845800aaa6be8dd

http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1-0potato3.dsc” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1-0potato3.dsc

MD5 checksum: caad999df0a24b07ecc9c98ff02a9260

http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1.orig.tar.gz” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/php4_4.0.3pl1.orig.tar.gz

MD5 checksum: e65b706a7fc4469d1ccd564ef8a2c534

Architecture independent components:

http://security.debian.org/dists/stable/updates/main/binary-all/php3-doc_3.0.18-0potato1.1_all.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-all/php3-doc_3.0.18-0potato1.1_all.deb

MD5 checksum: b3d80c7c4d88868baae39131d07190d9

http://security.debian.org/dists/stable/updates/main/binary-all/php4-dev_4.0.3pl1-0potato3_all.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-all/php4-dev_4.0.3pl1-0potato3_all.deb

MD5 checksum: 1d91f4365fe2ec5fbed5c3a26a852e1c

Alpha architecture:

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-gd_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-gd_3.0.18-0potato1.1_alpha.deb

MD5 checksum: c5648dc6802c11132a64b6de62e88952

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-imap_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-imap_3.0.18-0potato1.1_alpha.deb

MD5 checksum: a001b65cbcbdc25900306a0aac465c2d

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-ldap_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-ldap_3.0.18-0potato1.1_alpha.deb

MD5 checksum: 8d06ff903636edd03cae2bc9fbf049c4

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-magick_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-magick_3.0.18-0potato1.1_alpha.deb

MD5 checksum: 6af2006e5d223306eff0702311caa266

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-mhash_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-mhash_3.0.18-0potato1.1_alpha.deb

MD5 checksum: 31a37117d9e2475d1c657d54fe91b97d

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-mysql_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-mysql_3.0.18-0potato1.1_alpha.deb

MD5 checksum: 3e08b5a7c3dc413e262de6ea3f93f387

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-pgsql_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-pgsql_3.0.18-0potato1.1_alpha.deb

MD5 checksum: 9763d7699d35867880a78668595aab41

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-snmp_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-snmp_3.0.18-0potato1.1_alpha.deb

MD5 checksum: b9f8bd5d7bf264def15cb2a1fc040bff

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-xml_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi-xml_3.0.18-0potato1.1_alpha.deb

MD5 checksum: e100daab25752a1ffb57722aba643217

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-cgi_3.0.18-0potato1.1_alpha.deb

MD5 checksum: f213a0d5441c50f5d14c706cba7c99b9

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-dev_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-dev_3.0.18-0potato1.1_alpha.deb

MD5 checksum: b2691dde933907b9a760a3c62d928b87

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-gd_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-gd_3.0.18-0potato1.1_alpha.deb

MD5 checksum: e0a18a27b5a7488093f43beeecaee313

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-imap_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-imap_3.0.18-0potato1.1_alpha.deb

MD5 checksum: 362a93f221ca518be131f907ec01f772

http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-ldap_3.0.18-0potato1.1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/php3-ldap_3.0.18-0potato1.1_alpha.deb

MD5 checksum: fe1b52db95e01faa91e1977bc984462f