[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4E7E6623.5090408@sugarcrm.com>
Date: Sat, 24 Sep 2011 16:22:11 -0700
From: Stas Malyshev <smalyshev@...arcrm.com>
To: Vincent Danen <vdanen@...hat.com>
CC: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"security@....net" <security@....net>
Subject: Re: CVE request: is_a() function may allow arbitrary code execution
in PHP 5.3.7/5.3.8
Hi!
On 9/24/11 6:56 AM, Vincent Danen wrote:
> Could a CVE be assigned for this flaw? PHP 5.3.7 changed how the is_a()
> function worked, and as a result it could allow for remote arbitrary
> code execution if certain specific conditions are met (the blog post
> referenced below has a good writeup of the flaw).
I don't see what is to assign CVE to. Almost any function dealing with
classes as strings (including new $foo operator) can result in
autoloader call. If your autoloader is broken and your security
practices are non-existant, this can cause remote code execution. Just
as if you write in your script eval($_GET['hackme']), it can lead to
remote code execution. It is not a flaw in PHP, _GET or eval() function
- it is a flaw in how you use them. You should not be using them this
way, and if you have autoloader that does includes, you should check
what are you including and set allow_url_includes to Off.
> http://www.byte.nl/blog/2011/09/23/security-bug-in-is_a-function-in-php-5-3-7-5-3-8/
> https://bugs.php.net/bug.php?id=55475
> https://bugzilla.redhat.com/show_bug.cgi?id=741020
>
> It looks like this is the fix:
>
> http://svn.php.net/viewvc/?view=revision&revision=317183
This is not a "fix" - it is a reversal of BC break because it should
not be introduced in 5.3 version. However, that does not fix broken
autoloaders that accept any string as class name and try to load them.
It removes one specific code path that people misusing one specific
function were taking. If their autoloader is broken, they still can be
in trouble in other ways, and they need to fix their code.
--
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
