HTTP: Apache mod_php php_mime_split Heap Overflow

This signature detects attempts to exploit a known vulnerability against mod_php in Apache. Attackers can send a maliciously crafted HTTP POST request to execute arbitrary code on the affected server.

Extended Description

PHP is a widely deployed scripting language, designed for web based development and CGI programming. PHP does not perform proper bounds checking on in functions related to Form-based File Uploads in HTML (RFC1867). Specifically, this problem occurs in the functions which are used to decode MIME encoded files. As a result, it may be possible to overrun the buffer used for the vulnerable functions to cause arbitrary attacker-supplied instructions to be executed. PHP is invoked through webservers remotely. It may be possible for remote attackers to execute this vulnerability to gain access to target systems. A vulnerable PHP interpreter module is available for Apache servers that is often enabled by default.

Affected Products

Php php

References

BugTraq: 4183

CVE: CVE-2002-0081

URL: http://www.juniper.net/security/auto/vulnerabilities/vuln1085.html

Short Name

HTTP:APACHE:MODPHP-UPLOAD-HOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Apache mod_php php_mime_split Heap Overflow

Extended Description

Affected Products

References

Found a potential security threat?