Bug 1789069 (CVE-2019-11044)

Summary:	CVE-2019-11044 php: link function accepts filenames with embedded null byte and treats them as terminating at that byte on Windows
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, hhorak, jorton, rcollet, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	php 7.3.14RC1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was discovered in the link function in PHP. When compiled on Windows, it does not correctly handle paths containing NULL bytes. An attacker could abuse this flaw to bypass application checks on file paths.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-01-15 14:09:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1789070

Description Guilherme de Almeida Suckevicz 2020-01-08 16:46:30 UTC

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference:
https://bugs.php.net/bug.php?id=78862

Comment 1 Riccardo Schirone 2020-01-15 08:57:16 UTC

Upstream fix:
https://github.com/php/php-src/commit/0e6c0654ed06751ced134515f7629c40bd979d7f

Comment 2 Riccardo Schirone 2020-01-15 10:43:39 UTC

This flaw is present in the file ext/standard/link_win32.c, which is compiled only on Windows builds.

Similar code is present in ext/standard/link.c and there was a similar flaw there in the past, named CVE-2006-7243. This was however fixed in the versions of php we ship.

Comment 3 Riccardo Schirone 2020-01-15 10:47:02 UTC

Statement:

This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as the flaw only affects Windows builds. See CVE-2006-7243 for the Linux version of this flaw.

Comment 4 Product Security DevOps Team 2020-01-15 14:09:26 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11044