Search:

December 2005

Two PHP Security Advisories: 1. phpMyAdmin Variable Overwrite Vulnerability 2. libcurl URL Parsing Vulnerability

ID: 01087
Ref: 1015/2005
Date: 12 December 2005:15:37:27
Version: 1

Title: Two PHP Security Advisories: 1. phpMyAdmin Variable Overwrite Vulnerability 2. libcurl URL Parsing Vulnerability
Abstract:
Vendors affected: PHP
Operating systems affected: PHP
Applications affected: PHP

Title
=====

Two PHP Security Advisories:

1. phpMyAdmin Variable Overwrite Vulnerability

2. libcurl URL Parsing Vulnerability

Detail
======

1. phpMyAdmin comes with a register_globals emulation layer within
grab_globals.php, to ensure compatibility with hosts where this
feature is turned off. This layer was heavily modified for the
release of phpMyAdmin 2.7.0. One of the major changes is, that
the blacklist of variables that may not be overwritten by the
emulation layer is now stored in a global variable.

2. When libcurl parses an URL it first allocates certain buffers for
the hostname part and the path. As long the URL is short a minimum
amount of 256 bytes is allocated for each of these buffers.

1.

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================

ESB-2005.0973 -- [Win][UNIX/Linux]
phpMyAdmin Variable Overwrite Vulnerability
9 December 2005

===========================================================================

Product: phpMyAdmin 2.7.0
Publisher: Hardened-PHP Project
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact: Execute Arbitrary Code/Commands
Inappropriate Access
Access: Remote/Unauthenticated

Original Bulletin: http://www.hardened-php.net/advisory_252005.110.html

- - --------------------------BEGIN INCLUDED TEXT--------------------

- - -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hardened-PHP Project
www.hardened-php.net

-= Security Advisory =-

Advisory: phpMyAdmin Variable Overwrite Vulnerability
Release Date: 2005/12/07
Last Modified: 2005/12/07
Author: Stefan Esser [sesser@hardened-php.net]

Application: phpMyAdmin 2.7.0(-rc1)
Severity: A flaw in the variable overwrite protection may lead
to several XSS and local and remote file inclusion
vulnerabilities
Risk: Critical
Vendor Status: Vendor has released an updated version
References: http://www.hardened-php.net/advisory_252005.110.html

Overview:

Quote from www.phpmyadmin.net:
"phpMyAdmin is a tool written in PHP intended to handle the
administration of MySQL over the Web. Currently it can create
and drop databases, create/drop/alter tables, delete/edit/add
fields, execute any SQL statement, manage keys on fields, manage
privileges,export data into various formats and is available
in 50 languages."

A quick audit of the variable overwrite protection that was
redesigned for phpMyAdmin 2.7.0 revealed an easy to exploit flaw,
that leads to total failure of the protection and therefore
opens phpMyAdmin to a number of XSS, local and remote file
inclusion vulnerabilities.

Details:

phpMyAdmin comes with a register_globals emulation layer within
grab_globals.php, to ensure compatibility with hosts where this
feature is turned off. This layer was heavily modified for the
release of phpMyAdmin 2.7.0. One of the major changes is, that
the blacklist of variables that may not be overwritten by the
emulation layer is now stored in a global variable.

Unfortunately the variablename $import_blacklist is not covered
by the protection and therefore it was possible for an attacker
to overwrite the blacklist. After the blacklist is overwritten
an attacker can f.e. overwrite the $GLOBALS array with arbitrary
content and therefore exploit several places where the $GLOBALS
array is used.

During normal execution this $GLOBALS array is just another way
to access global variables, but when a script overwrites it,
it becomes a normal variable, with a few exceptions in PHP4.
For more information about what unexpected things can happen
when $GLOBALS is overwritten please have a look at

http://www.hardened-php.net/globals-problem

In phpMyAdmin $GLOBALS is used f.e. in the CSS generator to
access the global variable that stores the configuration. Due
to the fact, that the content of this variable is under total
control of the attacker the path to an included file can be
injected. This leads to an remote URL include vulnerability
in PHP5 and a local file include vulnerability in PHP4.

The difference is caused by the fact, that the PHP function
file_exists() does not work on URL wrappers within PHP4, but
works on ftp:// URLs in PHP5. (When the host is running our
Hardening-Patch for PHP such a remote URL inclusion is of
course not allowed and logged).

Please also note that there are multiple (easy) ways to
get PHP code into files on the server, so that local file
inclusion vulnerabilities are more dangerous than they seem.
Additionally it is possible to directly include PEAR.php
from the installed PHP distribution. If it is one that
was shipped with PHP <= 4.3.10 this can be used to directly
execute code on the server by manipulating the destructor
list.

There are other places in phpMyAdmin, where this vulnerability
can lead to XSS and other local file inclusion vulnerabilities.
Those will not be listed separately, because the problem
mentioned above is already serious enough to demonstrate the
impact of the failing overwrite protection.

Proof of Concept:

The Hardened-PHP project is not going to release exploits for
this vulnerability to the public.

Disclosure Timeline:

6. December 2005 - Disclosed vulnerability to vendor
7. December 2005 - Release of new phpMyAdmin version
7. December 2005 - Public Disclosure

Recommendation:

It is strongly recommended to upgrade to the new version of
phpMyAdmin which you can download at:

http://www.phpmyadmin.net/home_page/downloads.php

GPG-Key:

http://www.hardened-php.net/hardened-php-signature-key.asc

pub 1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key
Key fingerprint = 066F A6D0 E57E 9936 9082 7E52 4439 14CC 0A86 4AA1

Copyright 2005 Stefan Esser. All rights reserved.

- - -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFDlrwQRDkUzAqGSqERAmRXAJ91rK7yBmaD11xKZYT/3AQssLcx1ACdEmxV
ikwFLy/0HqQmcWp98DVzCVk=
=BCKL
- - -----END PGP SIGNATURE-----

- - --------------------------END INCLUDED TEXT--------------------

===========================================================================

iQCVAwUBQ5kZKSh9+71yA2DNAQLWlAP9GjjV/mcEvcak6dh4d0BVjT6mP5DpcIcJ
HKKDB4ffHEn4gnvzgSOIwLzz3GYenDYrbRocuAt0tHlhhn/E9WOibIwXvzy+CwVc
+7FZ3zWDBtmv6i3te20evftwqrSRQ6/vW/kBWDG+z3qP5uz2BjVWW3e5YE/Im0E1
J1iDSbqOUfQ=
=Wm2n
- -----END PGP SIGNATURE-----

2.

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================

ESB-2005.0974 -- [UNIX/Linux]
libcurl URL Parsing Vulnerability
9 December 2005

===========================================================================

Product: libcurl
Publisher: Hardened-PHP Project
Operating System: UNIX variants (UNIX, Linux, OSX)
Impact: Execute Arbitrary Code/Commands
Denial of Service
Access: Existing Account

Original Bulletin: http://www.hardened-php.net/advisory_242005.109.html

- - --------------------------BEGIN INCLUDED TEXT--------------------

- - -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hardened-PHP Project
www.hardened-php.net

-= Security Advisory =-

Advisory: libcurl URL Parsing Vulnerability
Release Date: 2005/12/07
Last Modified: 2005/12/07
Author: Stefan Esser [sesser@hardened-php.net]

Application: Curl <= 7.15.0
libcurl <= 7.15.0
Severity: When (lib)Curl tries to parse a certain kind of
malformed URLs this leads to a heap overflow
Risk: Low
Vendor Status: Vendor has released an updated version
References: http://www.hardened-php.net/advisory_242005.109.html

Overview:

libcurl is a free and easy-to-use client-side URL transfer library,
supporting FTP, FTPS, TFTP, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE
and LDAP. libcurl supports HTTPS certificates, HTTP POST, HTTP PUT,
FTP uploading, HTTP form based upload, proxies, cookies,
user+password authentication (Basic, Digest, NTLM, Negotiate,
Kerberos4), file transfer resume, http proxy tunneling and more!

During a quick scan of the URL parsing code within libcurl, it was
discovered, that certain malformed URLs trigger an off-by-one(two)
bufferoverflow. This may lead to unintended arbitrary code execution.

Because the attacker must be able to force curl to load such an URL,
which is not possible through a HTTP redirect, the impact is low.
However a local attacker might use this vulnerability to break out
of safe_mode/open_basedir restrictions when PHP is compiled with
libcurl support.

Details:

When libcurl parses an URL it first allocates certain buffers for
the hostname part and the path. As long the URL is short a minimum
amount of 256 bytes is allocated for each of these buffers.

When the input URL exceeds the 256 byte limit, libcurl allocates
the two buffers in a size that is exactly the lenght of the input
URL. For typical URLs this is enough (although space for the 0
string termination byte is not allocated).

The URL is then parsed by a number of sscanf calls. Unfortunately
certain malformed URLs will result in sscanf copying the complete
input URL into either the host or the path buffer. Because the
initial allocation did not allocate the extra space for the 0 byte
this eventually results in an off by one situation.

While this overflow with one zero byte is already enough to
manipulate certain implementaions of malloc()/free(), it is possible
to cause a two byte overflow by starting a hostname with a ?
When libcurl finds a ? in the hostname it suspects a malformed URL
and inserts a path seperator / infront of it. This is performed
without any kind of size check.

This vulnerability is believed to be only triggerable through direct
requesting curl to load a malformed URL and NOT through a HTTP
redirect. Because this is usually not possible for remote attackers,
this vulnerability is rated low risk. This vulnerability might
however be used to break out of PHP's safe_mode/open_basedir when
it is compiled against libcurl. Additonally such an exploit might be
used to steal the local SSL certificate from apache memory.

Proof of Concept:

The Hardened-PHP Project is not going to release an exploit for
this vulnerability to the public.

Disclosure Timeline:

29. November 2005 - Vulnerability was disclosed to the vendor
6. December 2005 - Vendor has released a bugfixed version
7. December 2005 - Public Disclosure

Recommendation:

We strongly recommend to upgrade to the vendor supplied new
version of curl and libcurl.

curl/libcurl 7.15.1
http://curl.haxx.se/download.html

GPG-Key:

http://www.hardened-php.net/hardened-php-signature-key.asc

pub 1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key
Key fingerprint = 066F A6D0 E57E 9936 9082 7E52 4439 14CC 0A86 4AA1

Copyright 2005 Stefan Esser / Hardened-PHP Project. All rights reserved.

- - -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFDlqvrRDkUzAqGSqERAvlmAJ9nJbJUh8PrFfUt3Oiuo/R6iPY5RwCgx6Te
kuEfsGf+Sv8AAJlARQPyrhM=
=C/3A
- - -----END PGP SIGNATURE-----

- - --------------------------END INCLUDED TEXT--------------------

iQCVAwUBQ5kcgih9+71yA2DNAQL6awP9G1QOBEntnD1lua6qgG8eRP6kMvwDvbV+
JsA7FJ8XtMwALM1Dj+laQV6MJfRX/osrNZ/RYiRr9c21dxYy9k9YF4zrNuwAhT5g
8huHsChVA227fRIzU150jwJDh48n9dPWWx6Kun6tzKVK0lku7mPvB0+uRSfCbPdJ
DTUhgfj6W28=
=dob4
- -----END PGP SIGNATURE-----