An invalid write vulnerability causing segmentation fault in phar on filename with \0 inside its name was found.
Vulnerable code (phar_analyze_path):
if (!(realpath = expand_filepath(filename, NULL))) {
efree(filename);
return FAILURE;
}
#ifdef PHP_WIN32
phar_unixify_path_separators(realpath, strlen(realpath));
#endif
slash = strstr(realpath, filename);
if (slash) {
slash += ((ext - fname) + ext_len);
*slash = '\0';
}
If fname and thus filename contain \0's, realpath would not contain those parts and thus slash would point past the end of the realpath buffer.
To exploit this, application has to allow attacker to create phar files with arbitrary filenames.
Upstream bug:
https://bugs.php.net/bug.php?id=71860
Upstream patch:
https://gist.github.com/smalyshev/80b5c2909832872f2ba2https://git.php.net/?p=php-src.git;a=commit;h=1e9b175204e3286d64dfd6c9f09151c31b5e099a
This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 6
Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
Red Hat Software Collections for Red Hat Enterprise Linux 7
Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html
An invalid write vulnerability causing segmentation fault in phar on filename with \0 inside its name was found. Vulnerable code (phar_analyze_path): if (!(realpath = expand_filepath(filename, NULL))) { efree(filename); return FAILURE; } #ifdef PHP_WIN32 phar_unixify_path_separators(realpath, strlen(realpath)); #endif slash = strstr(realpath, filename); if (slash) { slash += ((ext - fname) + ext_len); *slash = '\0'; } If fname and thus filename contain \0's, realpath would not contain those parts and thus slash would point past the end of the realpath buffer. To exploit this, application has to allow attacker to create phar files with arbitrary filenames. Upstream bug: https://bugs.php.net/bug.php?id=71860 Upstream patch: https://gist.github.com/smalyshev/80b5c2909832872f2ba2 https://git.php.net/?p=php-src.git;a=commit;h=1e9b175204e3286d64dfd6c9f09151c31b5e099a