Bug 1377311 (CVE-2016-7412)
| Summary: | CVE-2016-7412 php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abhgupta, apmukher, dmcphers, fedora, hhorak, huzaifas, jialiu, jokerman, jorton, lmeyer, mmccomas, rcollet, tiwillia, webstack-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | php 5.6.26, php 7.0.11 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 02:58:48 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1377366, 1554899 | ||
| Bug Blocks: | 1377365 | ||
|
Description
Adam Mariš
2016-09-19 12:23:54 UTC
Created php tracking bugs for this issue: Affects: fedora-all [bug 1377366] Analysis: You need a rogue mysql or a MITM attacker (who is impersonating as a mysql server) to set the correct bits, which causes the overflow on the php side. PHP applications which use databases are usually designed in way, in which the location of the database server (mysql in this case) is hardcoded into the application. The database server is usually administered by the same organization responsible for the PHP application and is therefore assumed to be trusted. Therefore for a typical PHP application, designed as mentioned above, the PHP code will need to be pointed to a rogue/MITM mysql server. This needs some kind of special privileges on the application (for example access to the admin site of the application) or another vulnerability in the affected application. Based on the above, it non-realistic to exploit the above flaw in typical real life PHP applications. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Via RHSA-2018:1296 https://access.redhat.com/errata/RHSA-2018:1296 |