PHP socket_connect Stack Overflow

Question

In the desciption of the vulnerability:

Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c 
in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute 
arbitrary code via a long pathname for a UNIX socket.

I can see how this might be a local issue, but how could an attacker potentially exploit this remotely?

EDIT:

Exact vulnerability: http://www.securityfocus.com/bid/47950

Answer 1

The exploit for this vulnerability turns the address argument in socket_connect() function into a sink that can be used to obtain code execution. In one attack scenario this vulnerability turns socket_connect() into a very serious exploitable php function. This attack could be used against an application like PHPProxy, where the attacker can control what address the application is connecting to.

However buffer overflows in PHP functions are more likely used in the post-exploitation phase of an attack. After the attacker compromises your system he can then use an exploit like the one above to bypass PHP safe_mode restrictions or disable_functions php.ini setting. For example, even if the system() function is disabled, a buffer overflow can still be used to drop the attacker to a shell. PHP safe_mode bypass exploits are very common, and that is the major reason why its being removed from the language.

Answer 2

I'm not intimately familiar with the details of this vulnerability, and you didn't link to any further information about it, but just based upon the information provided here:

If your PHP code allows remote users to influence the contents of the Unix socket pathname (something that may be rare, but perhaps not completely implausible), then a malicious remote user may plausibly be able to use their influence on the pathname to exploit the vulnerability.