php php CVE-2019-11043 vulnerability in PHP and Other Products
Published on October 28, 2019

Underflow in PHP-FPM can lead to RCE

product logo product logo product logo product logo product logo product logo
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.

The following remediation steps are recommended / required by April 15, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2019-11043 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is a Classic Buffer Overflow Vulnerability?

The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the program copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.

CVE-2019-11043 has been classified to as a Classic Buffer Overflow vulnerability or weakness.


Products Associated with CVE-2019-11043

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2019-11043 are published in these products:

PHP
 
Canonical Ubuntu Linux
 
Debian Linux
 
Fedora Project Fedora
 
Tenable Sc
 
Red Hat Enterprise Linux Desktop
 
Red Hat Enterprise Linux Workstation
 
Red Hat Enterprise Linux Scientific Computing
 
Red Hat Enterprise Linux Server
 
Red Hat Software Collections
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Enterprise Linux Server Aus
 
Red Hat Enterprise Linux Server Tus
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux Power Big Endian Eus
 
Red Hat Enterprise Linux Power Little Endian
 
Red Hat Enterprise Linux Power Little Endian Eus
 
Red Hat Enterprise Linux Ibm Z Systems Eus
 
Red Hat Enterprise Linux Ibm Z Systems
 
Red Hat Enterprise Linux Arm 64 Eus
 
Red Hat Enterprise Linux For Arm 64
 
Red Hat Enterprise Linux Power Big Endian
 
Red Hat Enterprise Linux Eus Compute Node
 

Affected Versions

PHP:

Exploit Probability

EPSS
94.06%
Percentile
99.90%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.