Bug 749182 (CVE-2011-4078)

Summary: CVE-2011-4078 php-pear-MDB2, roundcubemail: DoS (unavailability to access user's INBOX) after receiving an email message with the URL in the Subject
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: cwickert, fedora, gwync, mhlavink, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-10-27 10:57:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 749197, 749198, 749199, 749201, 749202    
Bug Blocks:    

Description Jan Lieskovsky 2011-10-26 12:32:39 UTC
A security flaw was found in the way Round Cube Webmail, a browser-based multilingual IMAP client, processed certail email-messages containing URL link in the message Subject, when the Suhosin check for dangerous PHP files inclusion was enabled. A remote attacker could send a specially-crafted email message to the victim, leading to denial of service (situation, where victim could not open their mail INBOX folder with the crafted email message present).

References:
[1] http://trac.roundcube.net/ticket/1488086
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=646675
[3] https://bugs.php.net/bug.php?id=55475

Comment 1 Jan Lieskovsky 2011-10-26 12:39:29 UTC
Relevant upstream patch:
[4] http://trac.roundcube.net/changeset/5222

Comment 2 Jan Lieskovsky 2011-10-26 12:42:16 UTC
Updated affected versions information:
======================================

The behaviour of is_a() PHP routine has been restored back to that one <= php-v5.3.6:
See

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379

for further information.

Thus this means:
================

This issue did NOT affect the versions of the php-pear-MDB2 package, as shipped with Fedora release of 14 and 15.

--

This issue did NOT affect the versions of the php-pear-MDB2 package, as shipped within Fedora EPEL 5 and Fedora EPEL 6 repositories.

Comment 3 Jan Lieskovsky 2011-10-26 12:58:24 UTC
Updated affected versions information:
======================================

The behaviour of is_a() PHP routine has been restored back to that one <= php-v5.3.6:
See

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379

for further information.

Thus this means:
================

This issue did NOT affect the version of the roundcubemail package, as shipped with Fedora release of 14 and Fedora release of 15.

--

This issue did NOT affect the versions of the roundcubemail package, as shipped with Fedora EPEL 6, Fedora EPEL 5, and Fedora EPEL 4.

Comment 4 Jan Lieskovsky 2011-10-26 13:17:19 UTC
CVE request:
[5] http://www.openwall.com/lists/oss-security/2011/10/26/2

Comment 5 Jan Lieskovsky 2011-10-26 13:19:21 UTC
Created php-pear-MDB2 tracking bugs for this issue

Affects: fedora-all [bug 749197]
Affects: epel-6 [bug 749198]
Affects: epel-5 [bug 749199]

Comment 6 Jan Lieskovsky 2011-10-26 13:20:51 UTC
Created roundcubemail tracking bugs for this issue

Affects: fedora-15 [bug 749201]
Affects: epel-6 [bug 749202]

Comment 7 Gwyn Ciesla 2011-10-26 13:25:35 UTC
This doesn't affect roundcubemail directly, we don't use the bundled version, we use system php-pear-MDB2.

Comment 8 Jan Lieskovsky 2011-10-26 13:33:29 UTC
Hi Jon,

(In reply to comment #7)
> This doesn't affect roundcubemail directly, we don't use the bundled version,
> we use system php-pear-MDB2.

Yes, that part about system php-pear-MDB2 is right. Though in the upstream patch there are also bits affecting direct roundcubemail code:

trunk/roundcubemail/program/steps/mail/func.inc

though not sure, how much important this change is to address the issue.

Also, not sure in which package to search for this change from upstream commit:

trunk/roundcubemail/program/lib/PEAR.php 

since it also doesn't seem to be directly shipped as part of roundcubemail package.

Thanks for hints, Jan.

Comment 9 Remi Collet 2011-10-26 14:00:06 UTC
According to upstream bug, this is related to php 5.3.7-5.3.8 is_a() new behavior.

So no version of RHEL provides this version.

In all fedora branches, I have revert the is_a behavior to the previous one (in fact backport the 5.3.9 behavior).

* Wed Sep 28 2011 Remi Collet <remi> 5.3.8-3
- revert is_a() to php <= 5.3.6 behavior (from upstream)
  with new option (allow_string) for new behavior

So I really think we are not affected

Comment 10 Remi Collet 2011-10-26 14:19:10 UTC
See Bug #741020 CVE-2011-3379

Comment 11 Vincent Danen 2011-10-26 16:12:39 UTC
This has been assigned the name CVE-2011-4078.

Comment 12 Gwyn Ciesla 2011-10-26 16:39:11 UTC
(In reply to comment #8)
> Hi Jon,
> 
> (In reply to comment #7)
> > This doesn't affect roundcubemail directly, we don't use the bundled version,
> > we use system php-pear-MDB2.
> 
> Yes, that part about system php-pear-MDB2 is right. Though in the upstream
> patch there are also bits affecting direct roundcubemail code:
> 
> trunk/roundcubemail/program/steps/mail/func.inc
> 
See Remi's answer.  I believe this is OK.

> though not sure, how much important this change is to address the issue.
> 
> Also, not sure in which package to search for this change from upstream commit:
> 
> trunk/roundcubemail/program/lib/PEAR.php 
> 
> since it also doesn't seem to be directly shipped as part of roundcubemail
> package.
> 
Correct.

> Thanks for hints, Jan.

Comment 13 Jan Lieskovsky 2011-10-27 10:43:13 UTC
As noted in https://bugzilla.redhat.com/show_bug.cgi?id=749182#c9, the behaviour of the is_a() routine in php package, as shipped with Fedora 14, 15, and upcoming Fedora 16 has been reverted back to behaviour <= php-v5.3.6. See bug:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379

for further details.

Comment 14 Jan Lieskovsky 2011-10-27 10:57:06 UTC
(In reply to comment #12)
> See Remi's answer.  I believe this is OK.

Remi, Jon, thanks for your replies due this one. Updated affects information and closed the relevant child bugs. Closing this one too.