Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the desciption of the vulnerability:

Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c 
in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute 
arbitrary code via a long pathname for a UNIX socket.

I can see how this might be a local issue, but how could an attacker potentially exploit this remotely?

EDIT:

Exact vulnerability: http://www.securityfocus.com/bid/47950

share|improve this question
add comment

2 Answers 2

up vote 0 down vote accepted

The exploit for this vulnerability turns the address argument in socket_connect() function into a sink that can be used to obtain code execution. In one attack scenario this vulnerability turns socket_connect() into a very serious exploitable php function. This attack could be used against an application like PHPProxy, where the attacker can control what address the application is connecting to.

However buffer overflows in PHP functions are more likely used in the post-exploitation phase of an attack. After the attacker compromises your system he can then use an exploit like the one above to bypass PHP safe_mode restrictions or disable_functions php.ini setting. For example, even if the system() function is disabled, a buffer overflow can still be used to drop the attacker to a shell. PHP safe_mode bypass exploits are very common, and that is the major reason why its being removed from the language.

share|improve this answer
    
So the only web servers in danger of being exploited are ones that allow users to somehow interact with the socket_connect() function, which would be quite rare? –  Bhubhu Hbuhdbus Apr 4 '12 at 2:06
    
@Bhubhu Hbuhdbus No, its mostly used for post-exploitation. I have updated my post. –  Rook Apr 4 '12 at 2:28
add comment

I'm not intimately familiar with the details of this vulnerability, and you didn't link to any further information about it, but just based upon the information provided here:

If your PHP code allows remote users to influence the contents of the Unix socket pathname (something that may be rare, but perhaps not completely implausible), then a malicious remote user may plausibly be able to use their influence on the pathname to exploit the vulnerability.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.