Bug 618167 (CVE-2010-1866, MOPS-2010-003)

Summary:

CVE-2010-1866 php: dechunk filter integer signedness error causing buffer overflow (MOPS-2010-003)

Product:

[Other] Security Response

Reporter:

Tomas Hoger <thoger>

Component:

vulnerability

Assignee:

Red Hat Product Security <security-response-team>

Status:

CLOSED NOTABUG

QA Contact:

Severity:

medium

Docs Contact:

Priority:

medium

Version:

unspecified

CC:

fedora, jorton, rpm

Target Milestone:

---

Keywords:

Security

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2013-04-11 19:58:34 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Bug Depends On:

624469

Bug Blocks:

Attachments:

Description	Flags
MOPS-2010-003 reproducer	none

Description Tomas Hoger 2010-07-26 10:20:30 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1866 to the following vulnerability:

The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder.

Reference:
http://php-security.org/2010/05/02/mops-2010-003-php-dechunk-filter-signed-comparison-vulnerability/index.html

Comment 1 Tomas Hoger 2010-07-26 10:23:47 UTC

Created attachment 434377 [details]
MOPS-2010-003 reproducer

Comment 2 Tomas Hoger 2010-07-26 10:25:18 UTC

dechunk filter is not available in pre-5.3 PHP versions.

Statement:

Not vulnerable. This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 3, 4, or 5, and Red Hat Application Stack v2.

Comment 3 Tomas Hoger 2010-07-26 10:29:34 UTC

Upstream commit:
  http://svn.php.net/viewvc?view=revision&revision=298700