Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 17 Apr 2015 16:45:18 -0400 (EDT)
Subject: Re: CVE Request: PHP potential remote code execution with apache 2.4 apache2handler

Hash: SHA1

> PHP 5.4.40, 5.5.24 and 5.6.8 fixed a potential remote code execution
> vulnerability when used with the Apache 2.4 apache2handler.
> (still private)
> Fixed by:

Use CVE-2015-3330. This CVE is for the following behavior in the
unpatched versions of PHP's sapi/apache2handler/sapi_apache2.c code:
lack of pool cleanup after each request in a series of pipelined HTTP
requests. This is a new scenario for pool cleanup, applicable during
interaction with Apache HTTP Server 2.4.x versions (interaction with
Apache HTTP Server 2.2.x versions had been working successfully).

The existence of this CVE does not mean that the
sapi/apache2handler/sapi_apache2.c code was "at fault" -- it only
means that, in practice, this sapi_apache2.c code wasn't compatible
with the 2.4.x behavior and therefore has now been changed.

The scope of this CVE does not include any other security implications
of the described behavior change between 2.2.x and 2.4.x: 'Apache 2.4
"broke" its API in the sense that the r->pool cleanup now happens
asynchronously with request processing - sending of reply data to the
client runs in parallel with processing the next request (of a
HTTP/1.1 pipelined connection, at least).'

The scope of this CVE does not include any security implications of
the described behavior of the "virtual" function in the post, e.g.,
"the ap_rflush() in zif_virtual() terminates the currently running
main request, in my testing, resulting in a completely crashing

Finally, the scope of this CVE does not, of course, include any
additional issue (if one exists) that was mentioned only in 68486, and
not mentioned in 69218.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.