漏洞描述
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
svn.php.nethttp://svn.php.net/viewvc?view=revision&revision=321003↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/72021↗secunia.comhttp://secunia.com/advisories/48668↗h20000.www2.hp.comhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041↗marc.infohttp://marc.info/?l=bugtraq&m=132871655717248&w=2↗www.securityfocus.comhttp://www.securityfocus.com/bid/51193↗support.apple.comhttp://support.apple.com/kb/HT5281↗www.securitytracker.comhttp://www.securitytracker.com/id?1026473↗www.redhat.comhttp://www.redhat.com/support/errata/RHSA-2012-0019.html↗marc.infohttp://marc.info/?l=bugtraq&m=133469208622507&w=2↗archives.neohapsis.comhttp://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html↗www.debian.orghttp://www.debian.org/security/2012/dsa-2399↗svn.php.nethttp://svn.php.net/viewvc?view=revision&revision=321040↗www.kb.cert.orghttp://www.kb.cert.org/vuls/id/903934↗secunia.comhttp://secunia.com/advisories/47404↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2012-0071.html↗www.ocert.orghttp://www.ocert.org/advisories/ocert-2011-003.html↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:197↗www.mandriva.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:150↗lists.apple.comhttp://lists.apple.com/archives/security-announce/2012/May/msg00001.html↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html↗www.nruns.comhttp://www.nruns.com/_downloads/advisory28122011.pdf↗