TITLE: PHP "sscanf()" Code Execution Safe Mode Bypass

SECUNIA ADVISORY ID: SA21403

VERIFY ADVISORY: http://secunia.com/advisories/21403/

CRITICAL: Less critical

IMPACT: Security Bypass

WHERE: Local system

SOFTWARE:
PHP 4.4.x -- http://secunia.com/product/5768/
PHP 5.1.x -- http://secunia.com/product/6796/

DESCRIPTION: Heintz has discovered a vulnerability in PHP, which potentially can be exploited by malicious, local users to bypass certain security restrictions. The vulnerability is caused due to an array boundary error in the "sscanf()" PHP function in the processing of the "$1s" format specifier. This can be exploited to reference freed memory by passing an variable as argument which has been unset. Successful exploitation may e.g. allow bypass of the safe mode protection by executing arbitrary code. The vulnerability has been confirmed in versions 5.1.4 and 4.4.3. Other versions may also be affected.

SOLUTION: The vulnerability has been fixed in the CVS repository. Grant only trusted users access to affected systems.

PROVIDED AND/OR DISCOVERED BY: Heintz

ORIGINAL ADVISORY: http://bugs.php.net/bug.php?id=38322