Security 11月 2, 2005
(Last Updated On: 2018年8月3日)







# この対策は脆弱性をほんの少し隠すくらいの意味しかありません。
## ワームなどに利用される可能性が高いPEAR.phpにアクセスさせない為
# PHP本体をアップグレードしないと根本的な対策となりません。


WikiにPHP 4.3.11、PHP 5.0.4用とPHP 5.0.5用のパッチを載せました。

PHP5.0.5はPHP4.4.0と同様に埋め込み定数参照の仕様が変更されています。PHP 4.3 -> PHP 4.4と同じ互換性問題がPHP 5.0.4 -> PHP 5.0.5で発生します。この為PHP 5.0.4とPHP 5.0.5の両方を用意しました。

パッチを見れば判りますがPHP 5.0.6となるCVSのPHP_5_0ブランチにはこの変更は組み込まれています。


Impact of GLOBALS overwrite

The impact of this kind of vulnerabilities is very high, because the problematic code seems to be secure unless you know about this behaviour of PHP and therefore very many applications are vulnerable to this problem. Additionally it is problematic, that the heart of PEAR (PEAR.php) also suffers from this vulnerability in PHP, although their code is written in a way that should be safe onder normal circumstances.

According to PHP usage statistics 71.03% of all servers, that announce a PHP4 version within their HTTP headers, are still using PHP <= 4.3.10. This actually means that most of the servers out there are running with old versions of PEAR where a application gets automatically vulnerable if it includes PEAR.php and is running with register_globals turned on. And this also means, that any PHP application that suffers from a local file include vulnerability can be easily turned into a remote code execution vulnerability by simply including the local copy of PEAR.php, that is usually in standard (or easyly guessable) paths. Additionally the PEAR directory is often trusted and therefore added as safe_mode_include_dir or to the open_basedir, so that it is even possible to include PEAR.php if SAFE_MODE or open_basedir is used to secure the system.

In the end it is simply unknown how many PHP applications suffer from these problems, because the problem is often overseen, widespread and unknown to a lot of security auditors. And with PEAR.php and vBulletin there are already two very big names on the list of affected applications.


– この脆弱性は非常に危険
– さらに悪いことにはPEAR.phpもこの脆弱性の影響を受ける
– 世の中にはPHP 4.3.10以下のサーバが多くある
– PEAR.phpのインクルードパスは信頼されている場合が多く、safe_mode, open_basedirによる保護が効かない
– 影響を付けるシステム、アプリケーションは数え切れないほど多い

PHP4ユーザは少なくとも今すぐPHP 4.3.11にアップグレードし、さらに$_FILESの脆弱性を埋めるパッチを適用するべきです。

PHP5ユーザはPHP 5.0.4またはPHP 5.0.5にアップグレードし脆弱性に対するパッチを適用するべきです。

投稿者: yohgaki