PHP up to 7.1.28/7.2.17/7.3.4 EXIF Extension exif_process_IFD_TAG memory corruption

Summaryinfo

A vulnerability classified as critical was found in PHP up to 7.1.28/7.2.17/7.3.4. The impacted element is the function exif_process_IFD_TAG of the component EXIF Extension. Such manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2019-11036. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in PHP up to 7.1.28/7.2.17/7.3.4 (Programming Language Software). Affected by this issue is the function exif_process_IFD_TAG of the component EXIF Extension. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

The bug was discovered 04/30/2019. The weakness was disclosed 05/03/2019 (Website). The advisory is shared for download at securityfocus.com. This vulnerability is handled as CVE-2019-11036 since 04/09/2019. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 172411 (SUSE Enterprise Linux Security Update for php5 (SUSE-SU-2019:1325-1)).

Upgrading to version 7.1.29, 7.2.18 or 7.3.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 108177†). The entries VDB-131531, VDB-131532, VDB-131533 and VDB-131534 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• PHP

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9
• 7.1.10
• 7.1.11
• 7.1.12
• 7.1.13
• 7.1.14
• 7.1.15
• 7.1.16
• 7.1.17
• 7.1.18
• 7.1.19
• 7.1.20
• 7.1.21
• 7.1.22
• 7.1.23
• 7.1.24
• 7.1.25
• 7.1.26
• 7.1.27
• 7.1.28
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.2.10
• 7.2.11
• 7.2.12
• 7.2.13
• 7.2.14
• 7.2.15
• 7.2.16
• 7.2.17
• 7.3.0
• 7.3.1
• 7.3.2
• 7.3.3
• 7.3.4

License

• open-source

Website

• Product: https://www.php.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion