Veracode Vulnerability DatabaseVERACODE:24807Denial Of Service (DoS)
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
php is vulnerable to denial of service (DoS). The vulnerability exists as it was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000.
References
archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
lists.apple.com/archives/security-announce/2012/May/msg00001.html
lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html
lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
marc.info/?l=bugtraq&m=132871655717248&w=2
marc.info/?l=bugtraq&m=133469208622507&w=2
rhn.redhat.com/errata/RHSA-2012-0071.html
secunia.com/advisories/47404
secunia.com/advisories/48668
support.apple.com/kb/HT5281
svn.php.net/viewvc?view=revision&revision=321003
svn.php.net/viewvc?view=revision&revision=321040
www.debian.org/security/2012/dsa-2399
www.exploit-db.com/exploits/18296
www.exploit-db.com/exploits/18305
www.kb.cert.org/vuls/id/903934
www.mandriva.com/security/advisories?name=MDVSA-2011:197
www.mandriva.com/security/advisories?name=MDVSA-2013:150
www.nruns.com/_downloads/advisory28122011.pdf
www.ocert.org/advisories/ocert-2011-003.html
www.oracle.com/technetwork/topics/security/cpujul2012-392727.html
www.redhat.com/support/errata/RHSA-2012-0019.html
www.securityfocus.com/bid/51193
www.securitytracker.com/id?1026473
access.redhat.com/errata/RHSA-2012:0033
access.redhat.com/security/updates/classification/#moderate
exchange.xforce.ibmcloud.com/vulnerabilities/72021
github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P