1

How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor currently does not provide any instructions on how to do this. I am working with a Linux platform.

  • Use an up to date copy of suhosin? – wireghoul Feb 19 '15 at 22:44
4

Stefan Esser actually wrote a proof of concept for this vulnerability. You can find the entire post here. I will not reproduce the code here because it's super long, but the general gist of it is this:

  1. Spray the heap with a repeated pattern of fake hashtables, buckets and zvals
  2. Trigger the malicious unserialize().
  3. Program segfaults
  4. Picking through the coredump reveals that you control the Return Instruction Pointer, and therefore have pwned the machine very, very hard.

This POC was developed for a Mac OSX system running PHP 5.4.24, so it may or may not work against a Linux system.

0

This isn't the sort of thing that can be verified like an OS vulnerability. If you have patched to the appropriate level, then you're covered.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.