Bug 820874 (CVE-2012-2335)

Summary:	CVE-2012-2335 php: incomplete CVE-2012-1823 fix - insecure wrapper
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, jorton, ldimaggi, mmcallis, rpm
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-27 16:17:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	820710

Description Tomas Hoger 2012-05-11 09:19:22 UTC

A CVE-2012-1823 was assigned to a PHP-CGI flaw that could allow remote attackers to execute arbitrary code by injecting php-cgi command line arguments via specially crafted query string.  Refer to bug #818607 for details about this flaw.

The released fix for this issue was reported to be incomplete and can be bypassed by prefixing the query string with spaces (e.g. ?+-s).  However, that problem only affected configurations where insecure wrapper script similar to the one pointed out in the CVE-2012-1823 reporter's blog post:

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
http://www.php.net/archive/2012.php#id2012-05-06-1
http://wiki.dreamhost.com/PHP.ini#Create_the_script_wrapper

While this problem is not a PHP flaw, it was mitigated in the upstream PHP versions 5.3.13 and 5.4.3 by skipping leading spaces in the query string before performing CVE-2012-1823 check:

http://git.php.net/?p=php-src.git;a=commitdiff;h=000e84aa88ce16deabbf61e7086fc8db63ca88aa

Red Hat PHP packages updates released to correct the CVE-2012-1823 issue do not include this mitigation.  Refer to bug #818607, comment #31 for information on how to correct such unsafe wrapper scripts.  Future Red Hat PHP packages updates may include this mitigation.

Comment 1 Tomas Hoger 2012-05-11 10:25:28 UTC

Mitre CVE description:

php-wrapper.fcgi does not properly handle command-line arguments,
which allows remote attackers to bypass a protection mechanism in PHP
5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper
interaction between the PHP sapi/cgi/cgi_main.c component and a query
string beginning with a +- sequence.

As mentioned above, this CVE is for insecure wrapper rather than PHP.

Comment 2 Tomas Hoger 2012-06-27 16:17:35 UTC

(In reply to comment #0)
> Red Hat PHP packages updates released to correct the CVE-2012-1823 issue do
> not include this mitigation.  Refer to bug #818607, comment #31 for
> information on how to correct such unsafe wrapper scripts.  Future Red Hat
> PHP packages updates may include this mitigation.

This mitigation is now included in the following PHP packages updates for Red Hat Enterprise Linux 5 and 6, which also address CVE-2012-2336 (bug #820708):

https://rhn.redhat.com/errata/RHSA-2012-1045.html
https://rhn.redhat.com/errata/RHSA-2012-1046.html
https://rhn.redhat.com/errata/RHSA-2012-1047.html

Comment 3 Martin Prpič 2015-04-16 08:24:10 UTC

Statement:

The mitigation for CVE-2012-2335 is included in the following PHP updates for Red Hat Enterprise Linux 5 and 6, which also address CVE-2012-2336 (BZ#820708):

https://rhn.redhat.com/errata/RHSA-2012-1045.html
https://rhn.redhat.com/errata/RHSA-2012-1046.html
https://rhn.redhat.com/errata/RHSA-2012-1047.html