Bug 479272 (CVE-2009-0754)

Summary:	CVE-2009-0754 PHP mbstring.func_overload web server denial of service
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	low
Version:	unspecified	CC:	herrold, jorton, kreilly, kurt, mjc, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-03-29 09:25:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	487359, 487360, 487361, 487368, 487369, 487370, 487371
Bug Blocks:

Description Josh Bressers 2009-01-08 15:19:26 UTC

This upstream PHP bug:
http://bugs.php.net/bug.php?id=27421

describes an issue where setting mbstring.func_overload = 7 in a .htaccess file, causes that setting to be set globally for the webserver.  This in turn breaks most unicode text operations, possibly hampering other sites hosted by the webserver.

Comment 4 Vincent Danen 2009-03-03 17:46:47 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0754 to
the following vulnerability:

Name: CVE-2009-0754
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754
Assigned: 20090303
Reference: MLIST:[oss-security] 20090130 CVE Request - php (PHP BZ#27421)
Reference: URL: http://www.openwall.com/lists/oss-security/2009/01/30/1
Reference: MLIST:[oss-security] 20090203 Re: CVE Request - php (PHP BZ#27421)
Reference: URL: http://www.openwall.com/lists/oss-security/2009/02/03/3
Reference: MLIST:[oss-security] 20090225 Re: CVE Request - php (PHP BZ#27421)
Reference: URL: http://www.openwall.com/lists/oss-security/2009/02/25/3
Reference: CONFIRM: http://bugs.php.net/bug.php?id=27421

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows
local users to modify behavior of other sites hosted on the same web
server by modifying the mbstring.func_overload setting within
.htaccess, which causes this setting to be applied to other virtual
hosts on the same server.

Comment 5 Kurt Seifried 2009-03-04 04:28:33 UTC

http://cvsweb.php.net/viewvc.cgi/php-src/ext/mbstring/mbstring.c?r1=1.276&r2=1.277

Comment 6 errata-xmlrpc 2009-04-06 16:38:18 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:0338 https://rhn.redhat.com/errata/RHSA-2009-0338.html

Comment 7 errata-xmlrpc 2009-04-06 16:51:16 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4

Via RHSA-2009:0337 https://rhn.redhat.com/errata/RHSA-2009-0337.html

Comment 8 errata-xmlrpc 2009-04-14 17:14:51 UTC

This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:0350 https://rhn.redhat.com/errata/RHSA-2009-0350.html

Comment 9 Tomas Hoger 2009-04-15 08:09:02 UTC

(In reply to comment #5)
> http://cvsweb.php.net/viewvc.cgi/php-src/ext/mbstring/mbstring.c?r1=1.276&r2=1.277  

The patch first appears upstream in 5.2.7.

Comment 10 Fedora Update System 2009-05-30 02:34:10 UTC

maniadrive-1.2-13.fc10, php-5.2.9-2.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2009-05-30 02:38:16 UTC

maniadrive-1.2-13.fc9, php-5.2.9-2.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.