CVE-2014-3668

What it actually does

Out-of-bounds read in date_from_ISO8601 during XMLRPC type handling leads to application crash via crafted xmlrpc_set_type or xmlrpc_decode arguments.

Why it matters to the business

Remote attackers can crash PHP-based services handling XMLRPC, causing denial of service and operational disruption for affected applications.

How an attack unfolds

An attacker supplies a malformed ISO8601 date string through an XMLRPC request to trigger the buffer overflow in the mkgmtime implementation, resulting in an out-of-bounds read and crash.

How to fix it

Upgrade PHP to 5.4.34 or later, 5.5.18 or later, or 5.6.2 or later. For the listed Ubuntu package apply the provided fixed version 11.2.202.481ubuntu0.14.04.1.

How to confirm the fix worked

Confirm PHP version is at or above the fixed releases; test XMLRPC functions with known-good and boundary ISO8601 inputs to verify no crash occurs.

Typical attack path

1. Identify a reachable PHP endpoint using the XMLRPC extension
2. Craft a malicious first argument for xmlrpc_set_type or argument for xmlrpc_decode containing invalid ISO8601 data
3. Send the request over the network to trigger the date parsing code path
4. Observe application crash confirming denial of service

How to detect it

Inspect web server and application logs for repeated or anomalous XMLRPC requests containing date strings; look for sudden PHP process crashes or segmentation faults around the time of such requests.

What your security team should do

• Prioritize patching PHP installations to the fixed versions immediately given public exploit availability
• Review and restrict exposure of XMLRPC endpoints if patching cannot be completed quickly
• Monitor EPSS score and exploit maturity for any change in threat level