PHP vulnerability CVE-2014-3597 - how/what can if affect?

Posted on 2014-10-07
Medium Priority
Last Modified: 2014-10-07
I'm trying to better understand PHP vulnerability CVE-2014-3597 and determine if this affects my environment or not (and how it could affect it if so)


Specifically, if I have a small network of servers, two running DNS, and some web servers running PHP (mostly Wordpress sites for example),  do I need to be concerned about this at the moment?  (my servers run Windows but this appears to affect all PHP installations)

The posted fix is to upgrade PHP, but due to scheduling I may not be able to do this for some time so trying to gauge the severity, this may not even apply to me I don't know.

The vulnerability seems to be related to DNS - which is why I'm not sure how to interpret this.  My DNS servers don't run PHP, and I don't understand if the web sites on my web servers that do run PHP are affected from this.

Which case is it....

- Sites with an affected PHP version can be used to DOS other sites on the Internet remotely?  (does the web site have to first be comprimised/files exploited, or a remote request to a URL on the server can trigger this)

- Web server is vulnerable to being successfully hit by a DOS attacked when sites are on that server with an affected PHP version?

The NIST site describes this as:

"Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049."

(as a side note, this does appear to affect PHP running in any OS,  https://bugs.php.net/bug.php?id=67717 shows the OS is "irrevelant" so I assume this does affect our environment but I'm looking for a clear explanation of exactly how we could be affected by this)

Can someone please explain how this could affect a web server hosting PHP web sites?

Thank you
Question by:Vas
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
LVL 35

Accepted Solution

gr8gonzo earned 1000 total points
ID: 40366099
Basically, the way the exploit works is that PHP has some functions that allow you to talk to a remote DNS server. For example, you might want to create an email validation application that takes an address like foobar@gmail.com, talks to gmail.com's DNS servers to find their MX servers so you can then ask the MX servers if they have a valid mailbox for "foobar". The process to query the DNS servers is flawed in the versions mentioned in the CVE.

Basically, if you run those DNS-querying functions on a vulnerable version of PHP, and you happen to query a malicious DNS server (not gmail.com but maybe reallybadguy.evil), that DNS server could return a DNS record that is NOT meant to actually give you real results but it is crafted in such a way that it tries to exploit the bug mentioned in the CVE. This isn't a perfect example, but it could return a DNS record that is so huge that it is bigger than what PHP expects, so PHP has a hard time storing the data, and the data that DOESN'T fit in PHP's buffer spills over into an area that could be executed as if it were another kind of authorized code.
LVL 35

Expert Comment

ID: 40366104
The short answer:
1. If you're not running PHP on a server, then that server will not be affected.
2. If you are running a vulnerable version of PHP but you are not doing any DNS queries, then you will not be affected.
3. If you are doing DNS queries against only known DNS servers (e.g. against your own internal servers), then you will not be affected.
4. If you are running a vulnerable version of PHP, and you are running a PHP script that queries DNS servers, AND you are not limiting/controlling which domains/DNS servers you query, then you could be at risk.
LVL 35

Expert Comment

ID: 40366111
On a side note, you'd also likely have to be under a direct attack from a malicious user. The user would have to know that you query DNS servers with PHP, so they would have to set up a DNS server to return malicious DNS records, and then would have to do something to prompt your script to contact their DNS server. Unless you're a target of value (to a random hacker), the chances of being hit are probably pretty low. That's a lot of trouble to go through if a hacker doesn't know all the circumstances upfront.
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

LVL 111

Assisted Solution

by:Ray Paseur
Ray Paseur earned 1000 total points
ID: 40366169
As I understand it, this bug is related to specific PHP functions and if your code does not use those functions, you're probably OK.  I say "probably" because the CVE and the bug report are not very clear.  Example: There is no such thing as the php_parserr function, nor is there dn_expand or dns_expand.  There is a dns_get_record() function, but you would know if you were using this in your code.  I made a search of all of my PHP libraries and I've never used it, even in external packages that I've installed, including WordPress, Joomla and others.

If it were my job to maintain the servers, I would want to make it a standard practice to keep PHP at the current level.  Current versions and release levels are shown on http://php.net
LVL 35

Expert Comment

ID: 40366407
The dn_expand and php_parserr functions are in the C source code for the engine. The dns_get_record PHP function is the exposed function that makes use of those from the compiled engine.

Author Closing Comment

ID: 40366495
Thank you for the feedback , it was very helpful. Much appreciated.

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lync server 2013 or Skype for business Backup Service Error ID 4049 – After File Share Migration
This article discusses how to implement server side field validation and display customized error messages to the client.
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question