MOPB Has Begun

Starting from March 1, 2007, the Month of PHP Bugs has begun. Here is an excerpt about this project :

This initiative is an effort to improve the security of PHP. However we will not concentrate on problems in the PHP language that might result in insecure PHP applications, but on security vulnerabilities in the PHP core. During March 2007 old and new security vulnerabilities in the Zend Engine, the PHP core and the PHP extensions will be disclosed on a day by day basis. We will also point out necessary changes in the current vulnerability managment process used by the PHP Security Response Team.

As of today, they have released five bugs :

• PHP 4 Userland ZVAL Reference Counter Overflow Vulnerability

In PHP 4 userland code is able to overflow the internal 16bit zval reference counter by creating many references to a variable. This leads to an exploitable double dtor condition.

• PHP Executor Deep Recursion Stack Overflow

A deep recursion of PHP userland code will exhaust all available stack which leads to a sometimes remotely triggerable crash.

• PHP Variable Destructor Deep Recursion Stack Overflow

The destruction of deeply nested PHP arrays will exhaust all available stack which leads to remotely triggerable crashes.

• PHP 4 unserialize() ZVAL Reference Counter Overflow

During unserialisation of user supplied data that contains a lot of references to a variable the internal 16bit zval reference counter can overflow. This leads to an exploitable double dtor condition.

• PHP unserialize() 64 bit Array Creation Denial of Service Vulnerability

Deserialisation of malformed PHP arrays from within unserialize() might result in a tight endless loop exhausting CPU ressources on 64bit systems.

Kind readers, please fasten your seatbelt during this month, especially if you are using PHP.