search
Homephp教程php手册PHP5.2.X防止Hash冲突拒绝服务攻击的Patch方法

上周的时候Dmitry突然在5.4发布在即的时候,引入了一个新的配置项:

Added max_input_vars directive to prevent attacks based on hash collision这个预防的攻击,就是”通过调用Hash冲突实现各种语言的拒绝服务攻击漏洞”(multiple implementations denial-of-service via hash algorithm collision).

攻击的原理很简单,目前很多语言,使用hash来存储k-v数据,包括常用的来自用户的POST数据, 攻击者可以通过构造请求头,并伴随POST大量的特殊的”k”值(根据每个语言的Hash算法不同而定制),使得语言底层保存POST数据的Hash表因为”冲突”(碰撞)而退化成链表.

这样一来,如果数据量足够大,那么就可以使得语言在计算,查找,插入的时候,造成大量的CPU占用,从而实现拒绝服务攻击.

PHP5.4是通过增加一个限制来尽量避免被此类攻击影响:

 - max_input_vars - specifies how many GET/POST/COOKIE input variables may be accepted. default value 1000 //phprm.com

大家如果有用5.2的, 如果被此类攻击威胁,可以打上下面的patch, PHP5.3的, 可以考虑升级到5.3.9, 已经包含了此patch(因为5.3.9目前是RC状态,所以如果不愿意升级, 也可以参照这个patch自己为5.3写一个):

防止办法

1.Cd into the PHP src run: patch -p1

2.Since the latest PHP 5.3.9-RC4 has fixed this issue, so for 5.3 you can upgrade to 5.3.9RC4

Of course if you don't want to upgrade to a RC version, you can simply tweak this patch into a 5.3 suitable patch.

大家可到https://github.com/laruence/laruence.github.com/tree/master/php-5.2-max-input-vars下载包.

教程地址:

欢迎转载!但请带上文章地址^^

Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

Repo: How To Revive Teammates
1 months agoBy尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks agoBy尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
1 months agoBy尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Atom editor mac version download

Atom editor mac version download

The most popular open source editor

mPDF

mPDF

mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),

SublimeText3 Linux new version

SublimeText3 Linux new version

SublimeText3 Linux latest version

VSCode Windows 64-bit Download

VSCode Windows 64-bit Download

A free and powerful IDE editor launched by Microsoft

ZendStudio 13.5.1 Mac

ZendStudio 13.5.1 Mac

Powerful PHP integrated development environment