Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2011-4885

Overview

Vulnerability Score 5.0 5.0
CVE Id CVE-2011-4885
Last Modified 10 Oct 2013 11:39:34
Published 29 Dec 2011 08:55:01
Confidentiality Impact NONE NONE
Integrity Impact NONE NONE
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2011-4885

Summary

PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Vulnerable Systems

Application

  • Php 5.0.0

  • Php 5.0.1

  • Php 5.0.2

  • Php 5.0.3

  • Php 5.0.4

  • Php 5.0.5

  • Php 5.1.1

  • Php 5.1.2

  • Php 5.1.3

  • Php 5.1.4

  • Php 5.1.5

  • Php 5.1.6

  • Php 5.2.0

  • Php 5.2.1

  • Php 5.2.10

  • Php 5.2.11

  • Php 5.2.12

  • Php 5.2.14

  • Php 5.2.15

  • Php 5.2.16

  • Php 5.2.17

  • Php 5.2.2

  • Php 5.2.3

  • Php 5.2.4

  • Php 5.2.5

  • Php 5.2.6

  • Php 5.2.7

  • Php 5.2.8

  • Php 5.2.9

  • Php 5.3.0

  • Php 5.3.1

  • Php 5.3.2

  • Php 5.3.3

  • Php 5.3.4

  • Php 5.3.5

  • Php 5.3.6

  • Php 5.3.7

  • Php 5.3.8


References

CERT-VN - VU#903934

MISC - http://www.ocert.org/advisories/ocert-2011-003.html

MISC - http://www.nruns.com/_downloads/advisory28122011.pdf

CONFIRM - http://svn.php.net/viewvc?view=revision&revision=321040

CONFIRM - http://svn.php.net/viewvc?view=revision&revision=321003

REDHAT - RHSA-2012:0019

MISC - https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py

BID - 51193

EXPLOIT-DB - 18305

EXPLOIT-DB - 18296

DEBIAN - DSA-2399

HP - HPSBUX02741

CONFIRM - http://support.apple.com/kb/HT5281

APPLE - APPLE-SA-2012-05-09-1

SECUNIA - 48668

SUSE - openSUSE-SU-2012:0426

HP - SSRT100877

HP - HPSBMU02786

CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html

XF - php-hash-dos(72021)

SECTRACK - 1026473

MANDRIVA - MDVSA-2011:197

SECUNIA - 47404

REDHAT - RHSA-2012:0071

BUGTRAQ - 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table

MANDRIVA - MDVSA-2013:150

Related Patches

Apple 2012-05-09 Mac OS X 10.7.4 Combo Update

Apple 2012-05-09 Mac OS X Server 10.7.4 Combo Update

Apple 2012-05-09 Mac OS X 10.7.4 Update

Apple 2012-05-09 Mac OS X Server 10.7.4 Update

Red Hat 2012:0019-01 RHSA Moderate: php53 and php security update for RHEL 5 x86

Red Hat 2012:0019-01 RHSA Moderate: php53 and php security update for RHEL 5 x86_64

Red Hat 2012:0033-01 RHSA Moderate: php security update for RHEL 5 x86

Red Hat 2012:0033-01 RHSA Moderate: php security update for RHEL 5 x86_64

Red Hat 2012:0071-01 RHSA Moderate: php security update for RHEL 4 x86

Red Hat 2012:0071-01 RHSA Moderate: php security update for RHEL 4 x86_64

Novell SUSE 2012:5964 apache2-mod_php5 security update for SLES 11 SP1 x86_64

Novell SUSE 2012:5964 apache2-mod_php5 security update for SLES 11 SP1 i586

Novell SUSE 2012:8009 apache2-mod_php5 security update for SLES 10 SP4 i586

Novell SUSE 2012:8009 apache2-mod_php5 security update for SLES 10 SP4 x86_64


Last Updated: 27 May 2016 10:57:58