Re: [Fwd: A NEW Vuln In PHP Interpreter.]

Hi, This doesn't look like a problem in PHP, but probably some faulty driver or hardware (might be also a low level Windows bug although it's less likely). An application is not supposed to be capable to reboot a server no matter what it does (well, unless it requests a reboot and has sufficient credentials to get one). If you're getting a bluescreen or a spontaneous reboot, it means that something prevented the OS from doing its memory-protection job properly, typically a faulty driver, memory problem or other hardware problem, and less often an OS bug. You should investigate whether this happens on other, different machines as well, to get a feel for whether this is a Windows bug or some problem on your specific system. Zeev At 19:36 28/08/2004, Gabor Hojtsy wrote:

Date: Fri, 27 Aug 2004 13:46:17 -0500 From: hackerdragons@turkgate.com Subject: A NEW Vuln In PHP Interpreter. To: webmaster@php.net A new vuln in PHP Interpreter. You Dont Even Need To Have PHP Installed To Reboot Win Servers. Hi, we're Doruk Babalýk & M.ali Akmanalp From Turkey. I Love To Code Sockets With PHP, So I Created A System That I Call PHPX, That's Composed Of php.exe, php.ini, php_sockets.dll, php5ts.dll. the php-cli compatible php code and a batchfile. This EXECUTES the PHP Code Without Requesting Any Other 3rd Party Program With The 4-File PHP Interpreter Within it. I'll Be Porting GTK2.0.0 When Avabile but nevermind. tahts not the case. when I Was Checking My Packet Flooder, I Realized That, Both if i use php://stdin or $argv, Windows XP PRO/HOME crashes and Reboots as it finishes executing socket_connect(); ONLY If, socket_create(AF_INET, SOCK_RAW, getprotobyhname("icmp")); Thats pretty serious. I'LL Be Testing It On NT and WinServer 2003 in a few minutes. however, the same vuln. may be avabile in linux. the vuln. is not sourced of my reducement in the php core files to "4".:).. The Full VERSÝON PHP5 Interpreter Does This As Well. But Only With My PHP Code. If YOU Exec on Apache, No Reboot. Cuz it's not php.exe, but apache.exe which opens the connection. but when u execute cli, reboot! An English version is included in this mail. aLSO wÝNserver doesnt need to have php, since i have PHPX, Only 1.7Mb in size, which requires absolutely no extra config, and works exactly aS A Runtime. all you have to do is to exec the batfile. ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php