Bug 802591 (CVE-2012-1171)

Summary:	CVE-2012-1171 php: libxml RSHUTDOWN function disables the hooks which are used to implement open_basedir
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-04-18 04:11:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	802592

Description Kurt Seifried 2012-03-13 02:35:41 UTC

From PHP bug 61367:

The libxml RSHUTDOWN function disables the hooks which are used to implement open_basedir. It is possible to run user code after RSHUTDOWN, for example using the stream_close() method of a custom stream wrapper. Such code is able to read arbitrary files via libxml.

The suggested fix is to move the code which disables the hooks to a post-deactivate function. All op arrays are destroyed before post-deactivate, so it is not possible for user code to be executed after post-deactivate.

Comment 4 Huzaifa S. Sidhpurwala 2012-04-18 04:11:53 UTC


*** This bug has been marked as a duplicate of bug 169857 ***

Comment 5 Huzaifa S. Sidhpurwala 2012-04-18 04:12:46 UTC

Statement:

We do not consider safe_mode / open_basedir restriction bypass issues to be security sensitive.  For more details see http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php