| Summary: | CVE-2011-4078 php-pear-MDB2, roundcubemail: DoS (unavailability to access user's INBOX) after receiving an email message with the URL in the Subject | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | cwickert, fedora, gwync, mhlavink, vdanen |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-10-27 10:57:06 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | 749197, 749198, 749199, 749201, 749202 | ||
| Bug Blocks: | |||
|
Description
Jan Lieskovsky
2011-10-26 12:32:39 UTC
Relevant upstream patch: [4] http://trac.roundcube.net/changeset/5222 Updated affected versions information: ====================================== The behaviour of is_a() PHP routine has been restored back to that one <= php-v5.3.6: See https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379 for further information. Thus this means: ================ This issue did NOT affect the versions of the php-pear-MDB2 package, as shipped with Fedora release of 14 and 15. -- This issue did NOT affect the versions of the php-pear-MDB2 package, as shipped within Fedora EPEL 5 and Fedora EPEL 6 repositories. Updated affected versions information: ====================================== The behaviour of is_a() PHP routine has been restored back to that one <= php-v5.3.6: See https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379 for further information. Thus this means: ================ This issue did NOT affect the version of the roundcubemail package, as shipped with Fedora release of 14 and Fedora release of 15. -- This issue did NOT affect the versions of the roundcubemail package, as shipped with Fedora EPEL 6, Fedora EPEL 5, and Fedora EPEL 4. CVE request: [5] http://www.openwall.com/lists/oss-security/2011/10/26/2 Created php-pear-MDB2 tracking bugs for this issue Affects: fedora-all [bug 749197] Affects: epel-6 [bug 749198] Affects: epel-5 [bug 749199] Created roundcubemail tracking bugs for this issue Affects: fedora-15 [bug 749201] Affects: epel-6 [bug 749202] This doesn't affect roundcubemail directly, we don't use the bundled version, we use system php-pear-MDB2. Hi Jon, (In reply to comment #7) > This doesn't affect roundcubemail directly, we don't use the bundled version, > we use system php-pear-MDB2. Yes, that part about system php-pear-MDB2 is right. Though in the upstream patch there are also bits affecting direct roundcubemail code: trunk/roundcubemail/program/steps/mail/func.inc though not sure, how much important this change is to address the issue. Also, not sure in which package to search for this change from upstream commit: trunk/roundcubemail/program/lib/PEAR.php since it also doesn't seem to be directly shipped as part of roundcubemail package. Thanks for hints, Jan. According to upstream bug, this is related to php 5.3.7-5.3.8 is_a() new behavior. So no version of RHEL provides this version. In all fedora branches, I have revert the is_a behavior to the previous one (in fact backport the 5.3.9 behavior). * Wed Sep 28 2011 Remi Collet <remi> 5.3.8-3 - revert is_a() to php <= 5.3.6 behavior (from upstream) with new option (allow_string) for new behavior So I really think we are not affected This has been assigned the name CVE-2011-4078. (In reply to comment #8) > Hi Jon, > > (In reply to comment #7) > > This doesn't affect roundcubemail directly, we don't use the bundled version, > > we use system php-pear-MDB2. > > Yes, that part about system php-pear-MDB2 is right. Though in the upstream > patch there are also bits affecting direct roundcubemail code: > > trunk/roundcubemail/program/steps/mail/func.inc > See Remi's answer. I believe this is OK. > though not sure, how much important this change is to address the issue. > > Also, not sure in which package to search for this change from upstream commit: > > trunk/roundcubemail/program/lib/PEAR.php > > since it also doesn't seem to be directly shipped as part of roundcubemail > package. > Correct. > Thanks for hints, Jan. As noted in https://bugzilla.redhat.com/show_bug.cgi?id=749182#c9, the behaviour of the is_a() routine in php package, as shipped with Fedora 14, 15, and upcoming Fedora 16 has been reverted back to behaviour <= php-v5.3.6. See bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379 for further details. (In reply to comment #12) > See Remi's answer. I believe this is OK. Remi, Jon, thanks for your replies due this one. Updated affects information and closed the relevant child bugs. Closing this one too. |