# Want to know about security vulnerablity that was fixed in PHP4.3.8

- Thread: https://externals.io/message/11366
- Original archive: https://news-web.php.net/php.internals/11366
- Started by Kamesh Jayachandran on 2004-07-20T08:42:50+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #11366 — Kamesh Jayachandran — 2004-07-20T08:42:50+00:00

URL: https://externals.io/message/11366#11366

Hi All,
I have PHP-4.2.3.
As per http://security.e-matters.de/advisories/112004.html , my PHP is
vulnerable.
I have a overview of the problem.
Can someone answer my questions which make my understanding of the
problem even better?
1)Only code that tries to create/initialize a Non-Persistent hash table
is vulnerable under certain cases.
True or False.
2)How come some remote attacker can set the Destructor to point to the
function of his choice?
3)Where can I get the patch for this vulnerablity for PHP-4.2.3.
4)Can some one point to the executable test case for this problem so
that I can test before and after incorporating the fix?

With regards
Kamesh Jayachandran

---

## #11368 — Stefan Esser — 2004-07-20T09:21:30+00:00

URL: https://externals.io/message/11366#11368 · In reply to: #11366

Hello,

> 1)Only code that tries to create/initialize a Non-Persistent hash table
> is vulnerable under certain cases.
> True or False.
False, anything that is not correctly initialised at the time the 
memory_limit request termination kicks in can potentially be exploited. 
This includes string pointers...

> 2)How come some remote attacker can set the Destructor to point to the
> function of his choice?
When memory is allocated it usually contains the content of the time 
before it was the last time freed. In PHP this especially true because 
of the memory cache. So the attacker creates some memory block of the 
correct size and by freeing it, it ends up on top of the memory cache.

> 3)Where can I get the patch for this vulnerablity for PHP-4.2.3.
By downloading it from the distributor of your choice of by doinig a 
diff between 4.3.7 and 4.3.8 and incorporating the fixes into the older 
version. The PHP developers are not going to create a patch for a 2 year 
old version.

> 4)Can some one point to the executable test case for this problem so
> that I can test before and after incorporating the fix?
Nice try. Until now noone has released an exploit for this bug to the 
public and therefore it is not a good idea to give one out at this time. 
For anyone into exploit developing there is already enough information 
in the advisory to create one.

Stefan Esser

PS: I am not going to answer any further mails about this.