Bug 573779 (CVE-2010-0397)

Summary:	CVE-2010-0397 php: NULL pointer dereference in XML-RPC extension
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jorton, tis, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://seclists.org/oss-sec/2010/q1/211
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 16:55:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	575712, 626733, 626734, 626735, 626736
Bug Blocks:

Description Jan Lieskovsky 2010-03-15 18:54:35 UTC

Auke van Slooten reported:
  [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573573

a deficiency in the way php's XML-RPC protocol extension decoded
specific requests. Decoding a certain XML file, in an application
using the php's XML-RPC protocol extension would lead to crash
of that application.

Comment 1 Jan Lieskovsky 2010-03-15 18:55:45 UTC

Example XML file leading to crash (from [1]):

<?php
$req = '<?xml version="1.0"?>
<methodCall>
   </methodCall>';
    $result = xmlrpc_decode_request( $req, $frop );
?>

Comment 4 Tomas Hoger 2010-03-22 08:22:43 UTC

Upstream bug report:
  http://bugs.php.net/bug.php?id=51288

Upstream commit:
  http://svn.php.net/viewvc?view=revision&revision=296152
  http://marc.info/?l=php-cvs&m=126850564920095&w=2

follow-up commit fixing memleak in the patch:
  http://svn.php.net/viewvc?view=revision&revision=296153
  http://marc.info/?l=php-cvs&m=126851202625683&w=2

Comment 5 Tomas Hoger 2010-03-22 08:29:12 UTC

This issue affects PHP packages in Red Hat Enterprise Linux 4 and 5.  XMLRPC extension is not enabled in Red Hat Enterprise Linux 3 PHP packages.

Comment 7 Tomas Hoger 2010-07-23 10:05:20 UTC

Fixed upstream in 5.3.3:
  http://www.php.net/releases/5_3_3.php

Comment 9 errata-xmlrpc 2010-11-29 21:34:19 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0919 https://rhn.redhat.com/errata/RHSA-2010-0919.html

Comment 10 Vincent Danen 2010-11-29 22:41:56 UTC

Statement:

This issue was addressed in the php packages as shipped with Red Hat Enterprise Linux 4 and 5 via: https://rhn.redhat.com/errata/RHSA-2010-0919.html