Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 May 2009 10:47:01 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: php mb_ereg_replace()


On Wed, 13 May 2009, Christian Hoffmann wrote:

> Regarding CVE... I'm not sure. It is not a vulnerability in PHP. It's a
> missing functionality which very very easily leads to severe security
> problems in apps which make use of the affected functions. And, this
> missing functionality is usually expected to be there, as preg_replace
> works like that. So.. tough case, imo.

We don't have a CVE for the fact that strcpy() exists - it can be used
safely even though it's dangerous.  My interpretation of this issue was
the same, so no CVE is needed.  Any PHP application that misuses
mb_ereg_replace(), however, is fair game.

(We already have a handful of CVEs for executable regexp's in PHP apps)

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.