CVE-2015-4024
published 2015-06-09CVE-2015-4024: Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before…
PriorityP336medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
41.79%
98.7th percentile
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.10.4 | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| hp | system_management_homepage | <= 7.5.3.1 | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
| oracle | solaris | — | — |
| php | php | <= 5.4.40 | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Target the multipart_buffer_headers function in main/rfc1867.c — a specially-crafted multipart/form-data HTTP POST request triggers algorithmic complexity (CPU exhaustion) in PHP's multipart parser. ↗
- →Monitor for HTTP POST requests with Content-Type: multipart/form-data that are abnormally large or contain unusual header structures, which may indicate exploitation attempts targeting the PHP multipart parser. ↗
- →Track upstream fix commit 4605d536d23b00813d11cc906bb48d39bdcf5f25 in php-src.git to confirm patched vs. unpatched PHP deployments. ↗
- ·The max_input_time php.ini setting (default 60s) limits the time spent parsing a malicious request and can be lowered as a mitigation; lowering post_max_size is an additional mitigation but may not be practical enough on its own. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-92mh-q8c5-wgqv: Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867
ghsa_unreviewed·2022-05-13
CVE-2015-4024 [MEDIUM] GHSA-92mh-q8c5-wgqv: Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
OSV
php5 vulnerabilities
osv·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] php5 vulnerabilities
php5 vulnerabilities
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015-4022,
CVE-2015-4643)
Shusheng Liu discovered that PHP inc
OSV
CVE-2015-4024: Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867
osv·2015-06-09·CVSS 5.0
CVE-2015-4024 [MEDIUM] CVE-2015-4024: Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015
Red Hat
php: multipart/form-data request parsing CPU usage DoS
vendor_redhat·2015-05-14·CVSS 5.0
CVE-2015-4024 [MEDIUM] CWE-407 php: multipart/form-data request parsing CPU usage DoS
php: multipart/form-data request parsing CPU usage DoS
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time.
Package: php (Red Hat Enterprise Linux 5) - Will not fix
Package: php53 (Red Hat Enterprise Linux 5) - Will not fix
Apple
CVE-2015-4024: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 5.0
CVE-2015-4024 [MEDIUM] CVE-2015-4024: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2015-4024
Component: CVE-2015-4024
No detection rules found.
Nuclei
WordPress Candidate Application Form <= 1.3 - Local File Inclusion
nuclei·CVSS 7.5
CVE-2015-1000005 [HIGH] WordPress Candidate Application Form <= 1.3 - Local File Inclusion
WordPress Candidate Application Form <= 1.3 - Local File Inclusion
WordPress Candidate Application Form <= 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks.
Template:
id: CVE-2015-1000005
info:
name: WordPress Candidate Application Form <= 1.3 - Local File Inclusion
author: dhiyaneshDK
severity: high
description: |
WordPress Candidate Application Form <= 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks.
impact: |
An attacker can exploit this vulnerability to read sensitive files on the server.
remediation: |
Update to the latest version of the plugin.
reference:
- https://wpscan.com/vulnerability/446233e9-33b3-4024-9b7d-63f9bb1dafe0
- https://nvd.nist.
Tenable
[R4] SecurityCenter 5.0.0.1 Affected by Third-party Library
blogs_tenable·2015-06-15
[R4] SecurityCenter 5.0.0.1 Affected by Third-party Library
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2015-4024 php: PHP Multipart/form-data remote dos Vulnerability [fedora-all]
bugzilla·2015-05-20·CVSS 5.0
CVE-2015-4024 [MEDIUM] CVE-2015-4024 php: PHP Multipart/form-data remote dos Vulnerability [fedora-all]
CVE-2015-4024 php: PHP Multipart/form-data remote dos Vulnerability [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2015-4024 php: multipart/form-data request parsing CPU usage DoS
bugzilla·2015-05-18·CVSS 5.0
CVE-2015-4024 [MEDIUM] CVE-2015-4024 php: multipart/form-data request parsing CPU usage DoS
CVE-2015-4024 php: multipart/form-data request parsing CPU usage DoS
Description of problem:
Upstream bug: https://bugs.php.net/bug.php?id=69364
Upstream fixed in 5.6.9/5.5.25/5.4.41.
Discussion:
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1223402]
---
When did you release the new rpm for this vulnerability?
We need rpm for the batch upgrade.
---
php-5.6.9-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
---
Upstream commit:
http://git.php.net/?p=php-src.git;a=commitdiff;h=4605d536d23b00813d11cc906bb48d39bdcf5f25
A specially-crafted multipart/form-data HTTP request can cause PHP to use an excessive amount of CPU time. The amount of time spent parsing such malicious request is l
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/159031.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00002.htmlhttp://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1186.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1187.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1219.htmlhttp://www.debian.org/security/2015/dsa-3280http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/74903http://www.securitytracker.com/id/1032432https://bugs.php.net/bug.php?id=69364https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763https://support.apple.com/kb/HT205031http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/159031.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00002.htmlhttp://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1186.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1187.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1219.htmlhttp://www.debian.org/security/2015/dsa-3280http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/74903http://www.securitytracker.com/id/1032432https://bugs.php.net/bug.php?id=69364https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763https://support.apple.com/kb/HT205031
2015-06-09
Published