PHP vulnerability CVE-2014-3597 - how/what can if affect?

I'm trying to better understand PHP vulnerability CVE-2014-3597 and determine if this affects my environment or not (and how it could affect it if so)

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3597


Specifically, if I have a small network of servers, two running DNS, and some web servers running PHP (mostly Wordpress sites for example),  do I need to be concerned about this at the moment?  (my servers run Windows but this appears to affect all PHP installations)

The posted fix is to upgrade PHP, but due to scheduling I may not be able to do this for some time so trying to gauge the severity, this may not even apply to me I don't know.


The vulnerability seems to be related to DNS - which is why I'm not sure how to interpret this.  My DNS servers don't run PHP, and I don't understand if the web sites on my web servers that do run PHP are affected from this.


Which case is it....

- Sites with an affected PHP version can be used to DOS other sites on the Internet remotely?  (does the web site have to first be comprimised/files exploited, or a remote request to a URL on the server can trigger this)

- Web server is vulnerable to being successfully hit by a DOS attacked when sites are on that server with an affected PHP version?


The NIST site describes this as:

"Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049."


(as a side note, this does appear to affect PHP running in any OS,  https://bugs.php.net/bug.php?id=67717 shows the OS is "irrevelant" so I assume this does affect our environment but I'm looking for a clear explanation of exactly how we could be affected by this)


Can someone please explain how this could affect a web server hosting PHP web sites?


Thank you
LVL 1
VasAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

gr8gonzoConsultantCommented:
Basically, the way the exploit works is that PHP has some functions that allow you to talk to a remote DNS server. For example, you might want to create an email validation application that takes an address like foobar@gmail.com, talks to gmail.com's DNS servers to find their MX servers so you can then ask the MX servers if they have a valid mailbox for "foobar". The process to query the DNS servers is flawed in the versions mentioned in the CVE.

Basically, if you run those DNS-querying functions on a vulnerable version of PHP, and you happen to query a malicious DNS server (not gmail.com but maybe reallybadguy.evil), that DNS server could return a DNS record that is NOT meant to actually give you real results but it is crafted in such a way that it tries to exploit the bug mentioned in the CVE. This isn't a perfect example, but it could return a DNS record that is so huge that it is bigger than what PHP expects, so PHP has a hard time storing the data, and the data that DOESN'T fit in PHP's buffer spills over into an area that could be executed as if it were another kind of authorized code.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gr8gonzoConsultantCommented:
The short answer:
1. If you're not running PHP on a server, then that server will not be affected.
2. If you are running a vulnerable version of PHP but you are not doing any DNS queries, then you will not be affected.
3. If you are doing DNS queries against only known DNS servers (e.g. against your own internal servers), then you will not be affected.
4. If you are running a vulnerable version of PHP, and you are running a PHP script that queries DNS servers, AND you are not limiting/controlling which domains/DNS servers you query, then you could be at risk.
0
gr8gonzoConsultantCommented:
On a side note, you'd also likely have to be under a direct attack from a malicious user. The user would have to know that you query DNS servers with PHP, so they would have to set up a DNS server to return malicious DNS records, and then would have to do something to prompt your script to contact their DNS server. Unless you're a target of value (to a random hacker), the chances of being hit are probably pretty low. That's a lot of trouble to go through if a hacker doesn't know all the circumstances upfront.
0
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Ray PaseurCommented:
As I understand it, this bug is related to specific PHP functions and if your code does not use those functions, you're probably OK.  I say "probably" because the CVE and the bug report are not very clear.  Example: There is no such thing as the php_parserr function, nor is there dn_expand or dns_expand.  There is a dns_get_record() function, but you would know if you were using this in your code.  I made a search of all of my PHP libraries and I've never used it, even in external packages that I've installed, including WordPress, Joomla and others.

If it were my job to maintain the servers, I would want to make it a standard practice to keep PHP at the current level.  Current versions and release levels are shown on http://php.net
0
gr8gonzoConsultantCommented:
The dn_expand and php_parserr functions are in the C source code for the engine. The dns_get_record PHP function is the exposed function that makes use of those from the compiled engine.
0
VasAuthor Commented:
Thank you for the feedback , it was very helpful. Much appreciated.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
PHP

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.