Date: Tue, 4 Sep 2012 11:51:16 +0400 From: Eygene Ryabinkin <rea-sec@...elabs.ru> To: oss-security@...ts.openwall.com Subject: Re: php header() header injection detection bypass Good day. Fri, Aug 31, 2012 at 05:42:14PM -0500, Raphael Geissert wrote: > All the bug reports I mentioned are about exactly the same issue. The non- > public ones have been marked as duplicates of the public one. > > I'm aware of at least 5.4.0 RC5 containing the incomplete fix, but I don't > know in which exact RC version it made its way into. 5.4.0 beta2 was still > vulnerable to CVE-2011-1398. > > PHP 5.4.1 RC1 already had the proper fix. As for PHP 5.3/5.2, the three patches are of concern,  http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/SAPI.c?r1=321634&r2=322263  http://svn.php.net/viewvc/php/php-src/trunk/main/SAPI.c?r1=321634&r2=323033  http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986 First one still has the possibility of injecting '\r' before the first '\n'. The second one kills the protection for the NUL byte check, so it won't allow header splitting for Apache SAPI, but FastCGI stuff will be affected, as per Stefan Esser's assessment, http://thread.gmane.org/gmane.comp.php.devel/70584 Third one fixes the issue. The check for 5.3 tags yields: - 5.3.11, https://github.com/php/php-src/blob/704bbb3263d0ec9a6b4a767bbc516e55388f4b0e/main/SAPI.c#L593 has the issue completely fixed - 5.3.10, https://github.com/php/php-src/blob/e4afa14812d10da7413096c742470fb0582ebc95/main/SAPI.c#L593 has none of the mentioned fixes. The check for 5.2 tags shows that - 5.2.17, https://github.com/php/php-src/blob/dabfd7727f5496ebd913488f6a996117f8597686/main/SAPI.c has none of the mentioned fixes. So, seems like we have the following vulnerable main versions: 5.2.0 <= php < 5.3.11, 5.4.0 <= php < 5.4.1. -- Eygene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.