Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 25 Sep 2011 01:56:59 -0700
From: Stas Malyshev <>
To: Pierre Joye <>
CC: Vincent Danen <>, 
 "" <>,
 "" <>
Subject: Re: CVE request: is_a() function may allow arbitrary code execution
 in PHP 5.3.7/5.3.8


On 9/25/11 1:28 AM, Pierre Joye wrote:
> It breaks the checks which leads to autoloader to accept bad input.
> Yes, the autoloader should have sanity check in place but this BC
> break changes the behavior and introduced this issue as well on top of
> it.
> I'm not sure either if we need a CVE as it is not a flaw in php itself
> per se. However the BC break introduces flaws in working codes, and
> that's a gray zone now.

Yes, it is a behavior change, and it shouldn't have happened in 5.3, the 
fact that it happened was a bad mistake, it is clear now.
However, the security flaw is squarely in the code that a) misuses is_a 
b) doesn't have security checks and c) does not follow recommended best 
practices about PHP settings.
As such, telling people that it was a flaw in PHP and that BC break 
reversal "fixed" it only gives them wrong ideas that their code was just 
fine. But in fact their code was broken and only by luck (and due to the 
haphazard way things were done in PHP where nobody bothered correlating 
function signatures with one another) in might have not been 
malfunctioning in this specific scenario. They need to fix that code 
ASAP, as they can not rely on luck anymore and they way is_a was changed 
is actually they way it should have worked from the start and the way 
is_subclass_of works right now.
Stanislav Malyshev, Software Architect
(408)454-6900 ext. 227

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.