[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 May 2009 14:25:42 +0200
From: Christian Hoffmann <hoffie@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: php mb_ereg_replace()
Heya,
On 2009-05-13 09:40, Sebastian Krahmer wrote:
> anyone aware of Bugtraq ID 34873 (http://www.securityfocus.com/bid/34873)?
> Seems there is no CVE or anything else (not even a patch).
Yes, I've quickly talked to upstream about this on IRC. The outcome was
that this cannot be fixed, both from a technical point of view (escaping
arbitrary multibyte data in a generic way) and from a backward
compatibility point of view (would change behavior).
While I'm far from being confident with that, I definitely see the points.
Related bug: http://bugs.php.net/bug.php?id=48180
A note has been added to the docs, as the bug states, but it doesn't
seem to be live anywhere yet.
I can share the IRC conversation log if the participating persons agree,
I'll quickly ask back.
Regarding CVE... I'm not sure. It is not a vulnerability in PHP. It's a
missing functionality which very very easily leads to severe security
problems in apps which make use of the affected functions. And, this
missing functionality is usually expected to be there, as preg_replace
works like that. So.. tough case, imo.
Hope this helps.
--
Christian Hoffmann
Gentoo PHP team
Download attachment "signature.asc" of type "application/pgp-signature" (262 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
