Bug 459572 (CVE-2008-3660)

Summary:	CVE-2008-3660 php: FastCGI module DoS via multiple dots preceding the extension
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, jorton, kreilly, rpm
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-23 22:31:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	487359, 487360, 487361, 487368, 487369, 487370, 487371
Bug Blocks:

Description Tomas Hoger 2008-08-20 09:48:51 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3660 to
the following vulnerability:

PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6, when used as a FastCGI module, allows remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using foo..php.

References:
http://bugs.gentoo.org/show_bug.cgi?id=234102
http://www.openwall.com/lists/oss-security/2008/08/08/2
http://www.openwall.com/lists/oss-security/2008/08/13/8

Comment 1 Tomas Hoger 2008-08-20 10:23:21 UTC

Upstream bug report:
http://bugs.php.net/bug.php?id=45151

Upstream patch:
http://cvs.php.net/viewvc.cgi/php-src/sapi/cgi/cgi_main.c?r1=1.267.2.15.2.57&r2=1.267.2.15.2.58&diff_format=u

Comment 5 Tomas Hoger 2009-03-25 09:07:23 UTC

This issue is unlikely to affect PHP installations running on Red Hat Enterprise Linux, as there's no FastCGI httpd module shipped.  Typical installations use PHP as an httpd module, and are not affected by this flaw.  Upcoming PHP security update will address this flaw.

Comment 6 errata-xmlrpc 2009-04-06 16:38:13 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:0338 https://rhn.redhat.com/errata/RHSA-2009-0338.html

Comment 7 errata-xmlrpc 2009-04-06 16:51:12 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4

Via RHSA-2009:0337 https://rhn.redhat.com/errata/RHSA-2009-0337.html

Comment 8 errata-xmlrpc 2009-04-14 17:14:44 UTC

This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:0350 https://rhn.redhat.com/errata/RHSA-2009-0350.html

Comment 9 Fedora Update System 2009-05-30 02:33:50 UTC

maniadrive-1.2-13.fc10, php-5.2.9-2.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2009-05-30 02:37:50 UTC

maniadrive-1.2-13.fc9, php-5.2.9-2.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.