oss-security - Re: CVE request: php 5.3.1 - "max_file_uploads" [was: Re: CVE request: php 5.3.1 update]

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 23 Nov 2009 14:51:28 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Thomas Biege <thomas@...e.de>, coley <coley@...re.org>
Subject: Re: CVE request: php 5.3.1 - "max_file_uploads"
 [was: Re: CVE request: php 5.3.1 update]

CVE-2009-4017

PHP versions before 5.3.1 contain a flow in the way multipart/form-data
handled file upload requests. A user making a specially crafted request could
cause the web server to consume resources processing the request.

http://www.php.net/releases/5_3_1.php
http://marc.info/?l=full-disclosure&m=125871907031725&w=2

Thanks.

-- 
    JB

----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote:

> Eren Türkay wrote:
> > On Friday 20 November 2009 12:41:50 pm Thomas Biege wrote:
> >> * Added "max_file_uploads" INI directive, which can be set to limit
> the
> >> number of file uploads per-request to 20 by default, to prevent
> possible
> >> DOS via temporary file exhaustion.
> > 
> > Bogdan Calin disclosed the details about that vulnerability on
> full-disclosure 
> > mailing list. He didn't disclosed his script but I wrote a PoC that
> works like 
> > a charm. It makes DoS possible for any server that runs PHP within 1
> minute 
> > with a few requests.
> > 
> > Additionally, this vulnerability affects 5.2.11. I guess all
> products before 
> > PHP 5.3.1 are vulnerable.
> > 
> > I think this deserves CVE Id. Any ideas?
> 
>    Josh, could you please allocate one?
> 
> Also changed the topic to match only 'php 5.3.1 - "max_file_uploads"'
> thing,
> so it isn't lost in other mails.
> 
> Thanks && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.