Bug 718253 (CVE-2011-1657)

Summary:	CVE-2011-1657 php: ZipArchive::addGlob() missing glob flags filtering
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	jorton
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-07-01 15:22:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	713201

Description Tomas Hoger 2011-07-01 15:12:22 UTC

Maksymilian Arciemowicz reported that PHP's (currently undocumented) ZipArchive::addGlob() does not sanitize flags argument before passing it to underlying libc's glob(3) function. When this function is called with specially crafted argument, this issue can trigger a crash in glob(). On Linux/glibc, this can be reproduced by using flags as GLOB_APPEND or GLOB_ALTDIRFUNC, which require certain setup of the glob_t structure before glob() is called.

Upstream bug report and commit:
https://bugs.php.net/bug.php?id=54681
http://svn.php.net/viewvc/?view=revision&revision=310814

Comment 3 Tomas Hoger 2011-07-01 15:22:00 UTC

This is under the full control of the script author, hence may possibly allow
safe_mode / open_basedir restrictions.

*** This bug has been marked as a duplicate of bug 169857 ***

Comment 4 Tomas Hoger 2011-07-01 15:22:53 UTC

Statement:

We do not consider safe_mode / open_basedir restriction bypass issues to be security sensitive.  For more details see https://bugzilla.redhat.com/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php