This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A resource management error in PHP's `multipart_buffer_headers` function. π₯ **Consequences**: Remote attackers can trigger a **Denial of Service (DoS)** via CPU exhaustion using crafted form data.β¦
π οΈ **Root Cause**: Algorithmic complexity flaw in `main/rfc1867.c`. π **CWE**: Not explicitly mapped in data, but it is a **Resource Management Error** leading to infinite loops or excessive processing.β¦
π¦ **Affected Versions**: β’ PHP **5.4.x** < 5.4.41 β’ PHP **5.5.x** < 5.5.25 β’ PHP **5.6.x** < 5.6.9 β οΈ All older versions of these branches are vulnerable.
Q4What can hackers do? (Privileges/Data)
π― **Attacker Action**: Remote DoS. π« **Privileges**: No code execution or data theft. The goal is simply to **consume CPU resources** until the service becomes unresponsive.β¦
π **Threshold**: **LOW**. π **Auth**: None required. It is a **Remote** vulnerability. Any user sending a specially crafted HTTP multipart form request can trigger the CPU spike. No login needed.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Public Exploit**: The data lists **references** (SecurityTracker, RedHat, Apple, Oracle) but **no specific PoC code** (`pocs` array is empty).β¦
π **Self-Check**: 1. Check PHP version (`php -v`). 2. If version is < 5.4.41 / 5.5.25 / 5.6.9, you are at risk. 3. Monitor for sudden **CPU spikes** associated with HTTP POST requests containing multipart data.
Q8Is it fixed officially? (Patch/Mitigation)
π‘οΈ **Official Fix**: **YES**. β’ Update to PHP **5.4.41+** β’ Update to PHP **5.5.25+** β’ Update to PHP **5.6.9+** Vendor patches (RedHat, Apple, Oracle) are available and confirmed.
Q9What if no patch? (Workaround)
π§ **No Patch Workaround**: 1. **WAF**: Block or inspect multipart form uploads. 2. **Rate Limiting**: Limit POST request frequency. 3.β¦
β‘ **Urgency**: **HIGH**. π **Published**: June 2015. While old, many legacy systems still run these versions. Since it allows **remote DoS** without authentication, it is a critical stability risk.β¦