News
Vigil@nce - PHP: buffer overflow of ibase_gen_id
August 2010 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
An attacker can create a PHP script using ibase_gen_id() in order to execute code.
Severity: 2/4
Creation date: 19/08/2010
DESCRIPTION OF THE VULNERABILITY
The PHP function ibase_gen_id() increments the named generator and returns its new value.
It takes the name of the generator in first arguments. This is a string which its copied in a local fixed size buffer. However, the ibase_gen_id() function verifies incorrectly the size of the first parameter. A attacker can therefore use ibase_gen_id() in order to generate an overflow.
An attacker can therefore create a PHP script using ibase_gen_id() in order to execute code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
GOLD SPONSOR
