PHP GD扩展释放资源访问代码执行漏洞

PHP是一款广泛使用的WEB开发脚本语言。

PHP GD扩展存在设计错误，远程攻击者可能利用此漏洞获得对释放内存的访问并使用恶意数据覆盖而执行任意代码。

问题存在于GD函数中，在通过资源识别器获得资源数据后，可能用usercode来中断PHP函数，usercode就会会破坏资源，并获取与其内存相同位置来分配PHP字符串相同大小的空间作为释放资源。这个字符串可以用于建立特定构建的资源，以允许利用内部PHP函数，当恶意中断终止函数时，会继续使用替代资源数据。导致任意代码执行。

要获得需要的函数中断，通常需要放置对象到函数的某个参数中，这会在转化一个超长值时触发PHP错误。

PHP PHP 5.2.1
PHP PHP 5.1.6
PHP PHP 5.1.5
PHP PHP 5.1.4
PHP PHP 5.1.3
PHP PHP 5.1.3
PHP PHP 5.1.2
PHP PHP 5.1.1
PHP PHP 5.1
PHP PHP 5.0.5
PHP PHP 5.0.4
PHP PHP 5.0.3

• Trustix Secure Linux 2.2
  PHP PHP 5.0.2
  PHP PHP 5.0.1
  PHP PHP 5.0 candidate 3
  PHP PHP 5.0 candidate 2
  PHP PHP 5.0 candidate 1
  PHP PHP 5.0 .0
  PHP PHP 4.4.6
  PHP PHP 4.4.5
  PHP PHP 4.4.4
  PHP PHP 4.4.3
  PHP PHP 4.4.2
  PHP PHP 4.4.1
  PHP PHP 4.4 .0
  PHP PHP 4.3.11
  PHP PHP 4.3.10
• Gentoo Linux
• RedHat Fedora Core3
• Trustix Secure Enterprise Linux 2.0
• Trustix Secure Linux 2.2
• Trustix Secure Linux 2.1
• Trustix Secure Linux 2.0
• Trustix Secure Linux 1.5
  PHP PHP 4.3.9
  PHP PHP 4.3.8
• MandrakeSoft Linux Mandrake 10.1 x86_64
• MandrakeSoft Linux Mandrake 10.1
• S.u.S.E. Linux Personal 9.2
• Turbolinux Turbolinux Server 10.0
• Ubuntu Ubuntu Linux 4.1 ppc
• Ubuntu Ubuntu Linux 4.1 ia64
• Ubuntu Ubuntu Linux 4.1 ia32
  PHP PHP 4.3.7
  PHP PHP 4.3.6
  PHP PHP 4.3.5
  PHP PHP 4.3.4
• MandrakeSoft Corporate Server 3.0 x86_64
• MandrakeSoft Corporate Server 3.0
• MandrakeSoft Linux Mandrake 10.0 AMD64
• MandrakeSoft Linux Mandrake 10.0
• S.u.S.E. Linux Personal 9.1
  PHP PHP 4.3.3
• S.u.S.E. Linux Personal 9.0 x86_64
• S.u.S.E. Linux Personal 9.0
• Turbolinux Home
• Turbolinux Turbolinux 10 F…
• Turbolinux Turbolinux Desktop 10.0
  PHP PHP 4.3.2
  PHP PHP 4.3.1
• MandrakeSoft Linux Mandrake 9.1 ppc
• MandrakeSoft Linux Mandrake 9.1
• OpenPKG OpenPKG Current
• S.u.S.E. Linux Personal 8.2
  PHP PHP 4.3
  PHP PHP 4.2.3
• EnGarde Secure Linux 1.0.1
• MandrakeSoft Corporate Server 2.1 x86_64
• MandrakeSoft Corporate Server 2.1
• MandrakeSoft Linux Mandrake 9.0
• Turbolinux Turbolinux Server 8.0
• Turbolinux Turbolinux Server 7.0
• Turbolinux Turbolinux Workstation 8.0
• Turbolinux Turbolinux Workstation 7.0
  PHP PHP 4.2.2
• Gentoo Linux 1.4 _rc1
• Gentoo Linux 1.2
• OpenPKG OpenPKG 1.1
• RedHat Linux 8.0 i386
• RedHat Linux 8.0
• S.u.S.E. Linux 8.1
  PHP PHP 4.2.1

• FreeBSD FreeBSD 4.6
• FreeBSD FreeBSD 4.5
• FreeBSD FreeBSD 4.4
• FreeBSD FreeBSD 4.3

• Slackware Linux 8.1
  PHP PHP 4.2 .0
  PHP PHP 4.2 -dev
  PHP PHP 4.1.2
• Apple Mac OS X 10.1.5
• Apple Mac OS X 10.1.4
• Apple Mac OS X 10.1.3
• Apple Mac OS X 10.1.2
• Apple Mac OS X 10.1.1
• Apple Mac OS X 10.1
• Apple Mac OS X 10.1
• Apple Mac OS X 10.0.4
• Apple Mac OS X 10.0.3
• Apple Mac OS X 10.0.2
• Apple Mac OS X 10.0.1
• Apple Mac OS X 10.0
• Debian Linux 3.0 sparc
• Debian Linux 3.0 s/390
• Debian Linux 3.0 ppc
• Debian Linux 3.0 mipsel
• Debian Linux 3.0 mips
• Debian Linux 3.0 m68k
• Debian Linux 3.0 ia-64
• Debian Linux 3.0 ia-32
• Debian Linux 3.0 hppa
• Debian Linux 3.0 arm
• Debian Linux 3.0 alpha
• MandrakeSoft Linux Mandrake 8.2 ppc
• MandrakeSoft Linux Mandrake 8.2
• MandrakeSoft Multi Network Firewall 2.0
• MandrakeSoft Single Network Firewall 7.2
  PHP PHP 4.1.1
• Conectiva Linux 7.0
  PHP PHP 4.1 .0
• S.u.S.E. Linux 8.0 i386
• S.u.S.E. Linux 8.0
  PHP PHP 4.0.7 RC3
  PHP PHP 4.0.7 RC2
  PHP PHP 4.0.7 RC1
  PHP PHP 4.0.7
  PHP PHP 4.0.6
• Caldera OpenLinux Server 3.1.1
• Caldera OpenLinux Server 3.1
• Caldera OpenLinux Workstation 3.1.1
• Caldera OpenLinux Workstation 3.1
• HP Secure OS software for Linux 1.0

• IBM AIX 4.3.3
• IBM AIX 4.3.2
• IBM AIX 4.3.1
• IBM AIX 4.3
• IBM AIX 5.1

• MandrakeSoft Corporate Server 1.0.1
• MandrakeSoft Linux Mandrake 8.1 ia64
• MandrakeSoft Linux Mandrake 8.1
• MandrakeSoft Linux Mandrake 8.0 ppc
• MandrakeSoft Linux Mandrake 8.0
• MandrakeSoft Linux Mandrake 7.2
• MandrakeSoft Linux Mandrake 7.1
• RedHat Linux 7.2 ia64
• RedHat Linux 7.2 i386
• RedHat Linux 7.2
• RedHat Linux 7.1 ia64
• RedHat Linux 7.1 i386
• RedHat Linux 7.1 alpha
• RedHat Linux 7.1
• RedHat Linux 7.0 i386
• RedHat Linux 7.0 alpha
• RedHat Linux 7.0
• S.u.S.E. Linux 7.3 sparc
• S.u.S.E. Linux 7.3 ppc
• S.u.S.E. Linux 7.3 i386
• S.u.S.E. Linux 7.3
• S.u.S.E. Linux 7.2 i386
• S.u.S.E. Linux 7.2
• Sun Cobalt RaQ 550
• Sun LX50
• Trustix Secure Linux 1.5
  PHP PHP 4.0.5
  PHP PHP 4.0.4
• Compaq Compaq Secure Web Server PHP 1.0
• Conectiva Linux 6.0
• Guardian Digital Engarde Secure Linux 1.0.1
• S.u.S.E. Linux 7.2
• S.u.S.E. Linux 7.1 x86
• S.u.S.E. Linux 7.1 sparc
• S.u.S.E. Linux 7.1 ppc
• S.u.S.E. Linux 7.1 alpha
• S.u.S.E. Linux 7.1
• S.u.S.E. Linux 7.0 sparc
• S.u.S.E. Linux 7.0 ppc
• S.u.S.E. Linux 7.0 i386
• S.u.S.E. Linux 7.0 alpha
• S.u.S.E. Linux 7.0
  PHP PHP 4.0.3 pl1
• S.u.S.E. Linux 6.4 ppc
• S.u.S.E. Linux 6.4 i386
• S.u.S.E. Linux 6.4 alpha
• S.u.S.E. Linux 6.4
  PHP PHP 4.0.3
• Debian Linux 2.2 sparc
• Debian Linux 2.2 powerpc
• Debian Linux 2.2 IA-32
• Debian Linux 2.2 arm
• Debian Linux 2.2 alpha
• Debian Linux 2.2 68k
• Debian Linux 2.2
• Sun Cobalt Control Station 4100CS
• Sun Cobalt Qube3 Japanese 4000WGJ
• Sun Cobalt Qube3 Japanese w/ Caching and RAID 4100WGJ
• Sun Cobalt Qube3 Japanese w/Caching 4010WGJ
• Sun Cobalt RaQ XTR 3500R
• Sun Cobalt RaQ XTR Japanese 3500R-ja
  PHP PHP 4.0.2
  PHP PHP 4.0.1 pl2
  PHP PHP 4.0.1 pl1
  PHP PHP 4.0.1
• Sun Cobalt Qube3 4000WG
• Sun Cobalt Qube3 w/ Caching and RAID 4100WG
• Sun Cobalt Qube3 w/Caching 4010WG
• Sun Cobalt RaQ4 3001R
• Sun Cobalt RaQ4 Japanese RAID 3100R-ja
• Sun Cobalt RaQ4 RAID 3100R
  PHP PHP 4.0 0
  PHP PHP 5.2
  目前没有详细解决方案提供：

<a href=“http://www.php.net/” target=“_blank”>http://www.php.net/</a>