PHP 5.3.5 dan 5.2.17 dirilis, memperbaiki potensi serangan DoS

Rilis ini mengatasi masalah keamanan kritis di mana interpreter PHP dapat macet saat melakukan konversi ganda pada string jika register FPU x87 digunakan secara internal. DoS Kerentanan ini dilaporkan sebagai bug PHP #53632 dan diberi kode CVE-2010-4645.

Untuk memverifikasi apakah sistem Anda juga terpengaruh, Anda dapat menggunakan skrip ini dan menjalankannya dari baris perintah:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
<?php
/* +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
   | Copyright (c) 2011 The PHP Group                                     |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
   | available through the world-wide-web at the following url:           |
   | http://www.php.net/license/3_01.txt                                  |
   | If you did not receive a copy of the PHP license and are unable to   |
   | obtain it through the world-wide-web, please send a note to          |
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
   | Author: Johannes Schlueter &lt;johannes@php.net&gt;                        |
   +----------------------------------------------------------------------+
*/

if (PHP_SAPI != 'cli') {
    die("Please run this test from CLI!\n");}

ini_set('display_errors', 1);
ini_set('output_buffering', 0);
error_reporting(-1);
if (!ini_get('safe_mode')) {
    set_time_limit(1);
}

echo "Testing float behaviour. If this script hangs or terminates with an error ".
     "message due to maximum execution time limit being reached, you should ".
     "update your PHP installation asap!\n";
echo "For more information refer to &lt;http://bugs.php.net/53632&gt;.\n";
$d = (double)"2.2250738585072011e-308";
echo "Your system seems to be safe.\n";

Open Source