Description
The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, which triggers memory corruption and allows local users to bypass safe_mode and execute arbitrary code via a certain unset operation after array_user_key_compare has been called.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 4.4.6/5.2.1 - 'array_user_key_compare()' ZVAL dtor Local Overflow EDB-3499 · local · Mar 16, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 22990 vdb-entry
- ADV-2007-2732 vdb-entry
- 25056 third-party-advisory
- 24542 third-party-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- GLSA-200705-19 vendor-advisory
- http://www.php-security.org/MOPB/MOPB-24-2007.html
- http://us2.php.net/releases/4_4_7.php
- USN-455-1 vendor-advisory
- http://us2.php.net/releases/5_2_2.php
- http://docs.info.apple.com/article.html?artnum=306172
- 25159 vdb-entry
- 25445 third-party-advisory
- 25057 third-party-advisory
- SUSE-SA:2007:032 vendor-advisory
- 26235 third-party-advisory