Date: Fri, 17 Apr 2015 16:45:18 -0400 (EDT) From: cve-assign@...re.org To: marc.deslauriers@...onical.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, security@....net Subject: Re: CVE Request: PHP potential remote code execution with apache 2.4 apache2handler -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > PHP 5.4.40, 5.5.24 and 5.6.8 fixed a potential remote code execution > vulnerability when used with the Apache 2.4 apache2handler. > > https://bugs.php.net/bug.php?id=69218 > https://bugs.php.net/bug.php?id=68486 (still private) > > Fixed by: > > http://git.php.net/?p=php-src.git;a=commit;h=809610f5ea38a83b284e1125d1fff129bdd615e7 Use CVE-2015-3330. This CVE is for the following behavior in the unpatched versions of PHP's sapi/apache2handler/sapi_apache2.c code: lack of pool cleanup after each request in a series of pipelined HTTP requests. This is a new scenario for pool cleanup, applicable during interaction with Apache HTTP Server 2.4.x versions (interaction with Apache HTTP Server 2.2.x versions had been working successfully). The existence of this CVE does not mean that the sapi/apache2handler/sapi_apache2.c code was "at fault" -- it only means that, in practice, this sapi_apache2.c code wasn't compatible with the 2.4.x behavior and therefore has now been changed. The scope of this CVE does not include any other security implications of the described behavior change between 2.2.x and 2.4.x: 'Apache 2.4 "broke" its API in the sense that the r->pool cleanup now happens asynchronously with request processing - sending of reply data to the client runs in parallel with processing the next request (of a HTTP/1.1 pipelined connection, at least).' The scope of this CVE does not include any security implications of the described behavior of the "virtual" function in the http://marc.info/?l=php-internals&m=142649836429352&w=2 post, e.g., "the ap_rflush() in zif_virtual() terminates the currently running main request, in my testing, resulting in a completely crashing apache." Finally, the scope of this CVE does not, of course, include any additional issue (if one exists) that was mentioned only in 68486, and not mentioned in 69218. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVMW7KAAoJEKllVAevmvmsNckH/2I6JBISE+Yi11TiNdxVmAy5 BsYG/4Lo85Ht1BPUZNJdKQJqmU0599dfytxWvgw5oqHZvGoJTHdMcpvORGTnZ0oI om+jC+qN9vdbzQvzxazJ0t2vlYzB3uwM1JO9q74QJXnGwaJc6fmKnMRi4ZzL9ygX 22mfBCFmB2TSa8yDxFRsLUPQlNHjOS4tdsT6QI0I5KDd1W+JY1dYwsMF1fwrncui 61OhG1/WW4Xq3i11i9P6C7XfLwvNl3kloSALCnGr5PZI9409sNDCwJ+ytqt8664U eUU8I4TPIOiS/t8DI1KMiCoBytkFO2eXD9vJvLywJjl3I4fpUAWNLQKHxnsG+Hk= =EOa/ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ