Bug 689386 (CVE-2011-1466)

Summary:	CVE-2011-1466 php: Crash by converting serial day numbers (SDN) into Julian calendar
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:	David Kutálek <dkutalek>
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dkutalek, fedora, jorton, rpm, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-01-30 18:46:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	740731, 740732, 740733, 740734, 768025, 769756, 769761, 831135
Bug Blocks:	715030, 750552

Description Jan Lieskovsky 2011-03-21 10:05:32 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1466 to
the following vulnerability:

Integer overflow in the SdnToJulian function in the Calendar extension
in PHP before 5.3.6 allows context-dependent attackers to cause a
denial of service (application crash) via a large integer in the first
argument to the cal_from_jd function.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1466
[2] http://bugs.php.net/bug.php?id=53574
[3] http://www.php.net/ChangeLog-5.php

Upstream patch:
[4] http://svn.php.net/viewvc/?view=revision&amp;revision=306475

Public PoC (from [2]):
======================
<?php
for(;;) {
    $x = rand(0, 2147483640);
    echo "$x\n";
    $dummy = cal_from_jd($x,0);
    $dummy = cal_from_jd($x,1);
}
?>

Comment 1 Jan Lieskovsky 2011-03-21 10:10:00 UTC

This issue affects the versions of the php package, as shipped with
Red Hat Enterprise Linux 4, 5, and 6.

This issue affects the version of the php53 package, as shipped with
Red Hat Enterprise Linux 5.

--

This issue affects the versions of the php package, as shipped with
Fedora release of 13 and 14.

Comment 8 errata-xmlrpc 2011-11-02 22:24:28 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:1423 https://rhn.redhat.com/errata/RHSA-2011-1423.html

Comment 9 Vincent Danen 2011-11-02 23:02:44 UTC

Statement:

(none)

Comment 12 Huzaifa S. Sidhpurwala 2012-01-17 04:06:25 UTC

This issue did not affect the version of php as shipped with Fedora 15 and Fedora 16.

Comment 13 errata-xmlrpc 2012-01-18 18:44:47 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0033 https://rhn.redhat.com/errata/RHSA-2012-0033.html

Comment 14 errata-xmlrpc 2012-01-30 18:18:32 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2012:0071 https://rhn.redhat.com/errata/RHSA-2012-0071.html