PHP vulnerability CVE-2014-3597 - how/what can if affect?

Posted on 2014-10-07
Last Modified: 2014-10-07
I'm trying to better understand PHP vulnerability CVE-2014-3597 and determine if this affects my environment or not (and how it could affect it if so)

Specifically, if I have a small network of servers, two running DNS, and some web servers running PHP (mostly Wordpress sites for example),  do I need to be concerned about this at the moment?  (my servers run Windows but this appears to affect all PHP installations)

The posted fix is to upgrade PHP, but due to scheduling I may not be able to do this for some time so trying to gauge the severity, this may not even apply to me I don't know.

The vulnerability seems to be related to DNS - which is why I'm not sure how to interpret this.  My DNS servers don't run PHP, and I don't understand if the web sites on my web servers that do run PHP are affected from this.

Which case is it....

- Sites with an affected PHP version can be used to DOS other sites on the Internet remotely?  (does the web site have to first be comprimised/files exploited, or a remote request to a URL on the server can trigger this)

- Web server is vulnerable to being successfully hit by a DOS attacked when sites are on that server with an affected PHP version?

The NIST site describes this as:

"Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049."

(as a side note, this does appear to affect PHP running in any OS, shows the OS is "irrevelant" so I assume this does affect our environment but I'm looking for a clear explanation of exactly how we could be affected by this)

Can someone please explain how this could affect a web server hosting PHP web sites?

Thank you
Question by:Vas
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
LVL 35

Accepted Solution

gr8gonzo earned 250 total points
ID: 40366099
Basically, the way the exploit works is that PHP has some functions that allow you to talk to a remote DNS server. For example, you might want to create an email validation application that takes an address like, talks to's DNS servers to find their MX servers so you can then ask the MX servers if they have a valid mailbox for "foobar". The process to query the DNS servers is flawed in the versions mentioned in the CVE.

Basically, if you run those DNS-querying functions on a vulnerable version of PHP, and you happen to query a malicious DNS server (not but maybe reallybadguy.evil), that DNS server could return a DNS record that is NOT meant to actually give you real results but it is crafted in such a way that it tries to exploit the bug mentioned in the CVE. This isn't a perfect example, but it could return a DNS record that is so huge that it is bigger than what PHP expects, so PHP has a hard time storing the data, and the data that DOESN'T fit in PHP's buffer spills over into an area that could be executed as if it were another kind of authorized code.
LVL 35

Expert Comment

ID: 40366104
The short answer:
1. If you're not running PHP on a server, then that server will not be affected.
2. If you are running a vulnerable version of PHP but you are not doing any DNS queries, then you will not be affected.
3. If you are doing DNS queries against only known DNS servers (e.g. against your own internal servers), then you will not be affected.
4. If you are running a vulnerable version of PHP, and you are running a PHP script that queries DNS servers, AND you are not limiting/controlling which domains/DNS servers you query, then you could be at risk.
LVL 35

Expert Comment

ID: 40366111
On a side note, you'd also likely have to be under a direct attack from a malicious user. The user would have to know that you query DNS servers with PHP, so they would have to set up a DNS server to return malicious DNS records, and then would have to do something to prompt your script to contact their DNS server. Unless you're a target of value (to a random hacker), the chances of being hit are probably pretty low. That's a lot of trouble to go through if a hacker doesn't know all the circumstances upfront.
Don't Cry: How Liquid Web is Ensuring Security

WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.

LVL 110

Assisted Solution

by:Ray Paseur
Ray Paseur earned 250 total points
ID: 40366169
As I understand it, this bug is related to specific PHP functions and if your code does not use those functions, you're probably OK.  I say "probably" because the CVE and the bug report are not very clear.  Example: There is no such thing as the php_parserr function, nor is there dn_expand or dns_expand.  There is a dns_get_record() function, but you would know if you were using this in your code.  I made a search of all of my PHP libraries and I've never used it, even in external packages that I've installed, including WordPress, Joomla and others.

If it were my job to maintain the servers, I would want to make it a standard practice to keep PHP at the current level.  Current versions and release levels are shown on
LVL 35

Expert Comment

ID: 40366407
The dn_expand and php_parserr functions are in the C source code for the engine. The dns_get_record PHP function is the exposed function that makes use of those from the compiled engine.

Author Closing Comment

ID: 40366495
Thank you for the feedback , it was very helpful. Much appreciated.

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you don't have the right permissions set for your WordPress location in IIS, you won't be able to perform automatic updates. Here's how to fix the problem.
If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

687 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question