possible dos attack with wordpress + php float issues with non cached sites - GoFuckYourself.com

fris · 01-04-2011, 10:13 AM

their is a float issue with php and it could be used for a denial of service attack, by simply visiting the url with many connections, like using apache benchmark tool. I submitted the bug to the wordpress trac.

just a warning/heads up.

http://core.trac.wordpress.org/ticket/16097

Jack Sparrow · 01-04-2011, 12:04 PM

Thanks fris.

Klen · 01-04-2011, 12:25 PM

Nice to know you even doing debugging now.

fris · 01-04-2011, 03:24 PM

hopefully this will be fixed soon

bl4h · 01-04-2011, 03:32 PM

I only cared about the PHP bug part

so i kept reading to find out where the problem is and apparently its an unfixable, design flaw in Intel architecture. i dont think wordpress will be able to fix it. cause no matter what you do even if you attempt to sanitize the number via php, its gonna to hit the bug. This doesnt effect all machines/setups, its a hardware thing

uno · 01-04-2011, 05:20 PM

I can't wait to upgrade AGAIN!

rowan · 01-04-2011, 05:27 PM

So this magic number is going to hang ANY php script which is expecting a number as an input variable?!? We're fucked then.

Wonder if $blah = round($_GET["variable"]); will also hang?

rowan · 01-04-2011, 06:14 PM

php -r "print 2.2250738585072011e-308;"

Tried it on all my servers running various versions of FreeBSD and PHP... 32 bit OS versions consistently hang, 64 bit ones work fine.

I bet a bunch of /b/'ers are creaming their pants right now.

edit: to answer my earlier question, php -r "echo round(2.2250738585072011e-308);" also hangs. Looks like fixing PHP is the only solution.

V_RocKs · 01-05-2011, 03:25 AM

Oh yeah... some of you fuckers are getting some love right now...

Muuaahhhahahahahahahaha!

01-04-2011, 10:13 AM	#1
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,359	possible dos attack with wordpress + php float issues with non cached sites their is a float issue with php and it could be used for a denial of service attack, by simply visiting the url with many connections, like using apache benchmark tool. I submitted the bug to the wordpress trac. just a warning/heads up. http://core.trac.wordpress.org/ticket/16097 __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

01-04-2011, 03:24 PM	#4
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,359	hopefully this will be fixed soon __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

01-04-2011, 03:32 PM	#5
bl4h Confirmed User Join Date: Jul 2006 Location: Philadelphia Posts: 1,282	I only cared about the PHP bug part so i kept reading to find out where the problem is and apparently its an unfixable, design flaw in Intel architecture. i dont think wordpress will be able to fix it. cause no matter what you do even if you attempt to sanitize the number via php, its gonna to hit the bug. This doesnt effect all machines/setups, its a hardware thing Last edited by bl4h; 01-04-2011 at 03:37 PM..

01-04-2011, 05:20 PM	#6
uno RIP Dodger. BEST.CAT.EVER Industry Role: Join Date: Dec 2002 Location: NYC Area Posts: 18,450	I can't wait to upgrade AGAIN! __________________ -uno icq: 111-914 CrazyBabe.com - porn art MojoHost - For all your hosting needs, present and future. Tell them I sent ya!

01-04-2011, 06:14 PM	#8
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	php -r "print 2.2250738585072011e-308;" Tried it on all my servers running various versions of FreeBSD and PHP... 32 bit OS versions consistently hang, 64 bit ones work fine. I bet a bunch of /b/'ers are creaming their pants right now. edit: to answer my earlier question, php -r "echo round(2.2250738585072011e-308);" also hangs. Looks like fixing PHP is the only solution. Last edited by rowan; 01-04-2011 at 06:16 PM..

01-04-2011, 12:04 PM	#2
Jack Sparrow Almost goners.. Industry Role: Join Date: May 2008 Location: Netherlands Posts: 11,420	Thanks fris.

01-04-2011, 12:25 PM	#3
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Nice to know you even doing debugging now.

01-04-2011, 05:27 PM	#7
rowan Too lazy to set a custom title Join Date: Mar 2002 Location: Australia Posts: 17,393	So this magic number is going to hang ANY php script which is expecting a number as an input variable?!? We're fucked then. Wonder if $blah = round($_GET["variable"]); will also hang?

01-05-2011, 03:25 AM	#9
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,409	Oh yeah... some of you fuckers are getting some love right now... Muuaahhhahahahahahahaha!