Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).

The remote host is running a version of PHP 4.x older than 4.3.0.  As such, it reportedly has an integer overflow in array creation that can be triggered by user-input passed to an 'unserialize()' function. 

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on this host.

 According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.0.  Such versions may be affected by several buffer overflows To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script to the remote server, or to be able to manipulate several variables processed by some PHP functions such as htmlentities(). 

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.  Such versions may be affected by several buffer overflows. 

To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script on the remote server or to manipulate several variables processed by some PHP functions such as 'htmlentities().'

The ini_restore() method could be exploited to reset options set in the webserver config to their default values. (CVE-2006-4625)

The memory handling routines contained an integer overflow.
(CVE-2006-4812)

The stripos() function did not check for invalidly long or empty haystack strings. In an application that uses this function on arbitrary untrusted data this could be exploited to crash the PHP interpreter. (CVE-2006-4485)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly. A remote attacker could exploit this to cause a Denial of Service attack through memory exhaustion. (CVE-2006-4486)

Maksymilian Arciemowicz discovered that security relevant configuration options like open_basedir and safe_mode (which can be configured in Apache's httpd.conf) could be bypassed and reset to their default value in php.ini by using the ini_restore() function.
(CVE-2006-4625)

Stefan Esser discovered that the ecalloc() function in the Zend engine did not check for integer overflows. This particularly affected the unserialize() function. In applications which unserialize untrusted user-defined data, this could be exploited to execute arbitrary code with the application's privileges. (CVE-2006-4812).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ini_restore() method could be exploited to reset options set in the webserver config to their default values (CVE-2006-4625).

The memory handling routines contained an integer overflow (CVE-2006-4812).

The remote host is affected by the vulnerability described in GLSA-200610-14 (PHP: Integer overflow)

    A flaw in the PHP memory handling routines allows an unserialize() call     to be executed on non-allocated memory due to a previous integer     overflow.
  Impact :

    An attacker could execute arbitrary code with the rights of the web     server user or the user running a vulnerable PHP script.
  Workaround :

    There is no known workaround at this time.

Updated PHP packages that fix an integer overflow flaw are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

An integer overflow was discovered in the PHP memory handling routines. If a script can cause memory allocation based on untrusted user data, a remote attacker sending a carefully crafted request could execute arbitrary code as the 'apache' user. (CVE-2006-4812)

This issue did not affect the PHP packages distributed with Red Hat Enterprise Linux 3 or 4.

Users of PHP should upgrade to these updated packages which contain a backported patch that corrects this issue.

Stefan Esser reports :

The PHP 5 branch of the PHP source code lacks the protection against possible integer overflows inside ecalloc() that is present in the PHP 4 branch and also for several years part of our Hardening-Patch and our new Suhosin-Patch.

It was discovered that such an integer overflow can be triggered when user input is passed to the unserialize() function. Earlier vulnerabilities in PHP's unserialize() that were also discovered by one of our audits in December 2004 are unrelated to the newly discovered flaw, but they have shown, that the unserialize() function is exposed to user-input in many popular PHP applications. Examples for applications that use the content of COOKIE variables with unserialize() are phpBB and Serendipity.

The successful exploitation of this integer overflow will result in arbitrary code execution.

The remote host is running PHP 4.3.0.

There is a flaw in this version that could allow an attacker to execute arbitrary PHP code on this host.

ID	Name	Product	Family	Severity
17796	PHP 4.x < 4.3.0 ZendEngine Integer Overflow	Nessus	CGI abuses	high
4444	PHP 5.x < 5.2.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
31649	PHP 5.x < 5.2 Multiple Vulnerabilities	Nessus	CGI abuses	high
29375	SuSE 10 Security Update : PHP (ZYPP Patch Number 2152)	Nessus	SuSE Local Security Checks	critical
27942	Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-362-1)	Nessus	Ubuntu Local Security Checks	critical
27147	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-2153)	Nessus	SuSE Local Security Checks	critical
22929	GLSA-200610-14 : PHP: Integer overflow	Nessus	Gentoo Local Security Checks	critical
22524	RHEL 2.1 : php (RHSA-2006:0708)	Nessus	Red Hat Local Security Checks	critical
22520	FreeBSD : php -- _ecalloc Integer Overflow Vulnerability (e329550b-54f7-11db-a5ae-00508d6a62df)	Nessus	FreeBSD Local Security Checks	critical
11237	PHP < 4.3.1 CGI Module Force Redirect Settings Bypass Arbitrary File Access	Nessus	CGI abuses	high

Detections

Analytics

CVE-2006-4812

critical

Tenable Plugins

high

high

high

critical

critical

critical

critical

critical

critical

high