[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4FB8721E.5000406@redhat.com>
Date: Sat, 19 May 2012 22:25:02 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: msantand@....sans.org
Subject: Re: CVE Request: PHP 5.4.3 on Windows com_print_typeinfo()
Buffer Overflow (?)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/19/2012 10:23 PM, Kurt Seifried wrote:
> Original sources:
> https://isc.sans.edu/diary/PHP+5+4+Remote+Exploit+PoC+in+the+wild/13255
>
>
http://packetstormsecurity.org/files/112851/php54-exec.txt
> http://www.exploit-db.com/exploits/18861/
> http://www.reddit.com/r/netsec/comments/tuyp3/isc_diary_php_54_remote_exploit_poc_in_the_wild/
>
> From the exploit:
>
> // Exploit Title: PHP 5.4 (5.4.3) Code Execution 0day (Win32) //
> Exploit author: 0in (Maksymilian Motyl) // Email:
> 0in(dot)email(at)gmail.com // * Bug with Variant type parsing
> originally discovered by Condis // Tested on Windows XP SP3 fully
> patched (Polish)
>
> There appears to be a buffer overflow in com_print_typeinfo(), it
> appears to only affect PHP on Windows (COM object related).
Please use CVE-2012-2376 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJPuHIeAAoJEBYNRVNeJnmTQXoP/3OD9gIBD2mC8aHtktZeSVHt
4lWz1ONf6cMazdiOZjHGF7OK/ZIIFoocAVpwxKUjCoTWRPoboQOnrenY/ff0kD/x
MqIm84i51Yqzjbh+3MM9muzjJ2PmvahNmlV7hjEcyJWHww8NiEs1kxtGGrGcb0dU
caJSkCaauXrlbBOpwOpx56WiKebuV5v0kxPTs6fQSapmyAiBL82k+194VYJ6GKHS
vU8vf9XF3XGV+Z/wojRaETN5nBRtcssKJCUHquin+PRmyZoljyQFpj7QKm1uNXAX
A14kYz0XjwqgkJxjVWaGF5Y7tcWsAIUcxNby6WyBK1ewzQpiyVPt5/W9/OyWzs31
Dxi78nm5MlCq0xVkTUpvg9bVvnEyg+ZkA2FKVnwJl+AWAP0p3QEDrn7ocyEJl7PU
6FpTQ+JYN13p1bJrGJsP1SXhh8/pyA0BsYUEyREQmgo6CA6p6vTvRHxIXdpEf1dt
T0P/iBXPLb7+kK5m8UMlXQ7cGfRusO2qJFt9ratT+K/cEoKDutvNCmSaucfDNgLS
tx/+BiC5e/MmAaMUOgGwAw2bP2LTWKNj/xAg4rpkQm4oYZHgfsGLpeTnd/MogLpH
DYzAADhuDcZbkY0qy31vNINC4aWUcr+2nqEeSHNdoTHev4h540iUHdm4juPX3czc
J3CFF70WsHikbJeyrPx/
=YHEn
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
