Bug 835024 (CVE-2010-2950, MOPS-2010-024)

Summary:	CVE-2010-2950 php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jorton
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	php 5.3.4	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-27 16:09:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	830727, 830728, 830729, 830730
Bug Blocks:	823468, 835959, 835960

Description Huzaifa S. Sidhpurwala 2012-06-25 09:52:46 UTC

A format string vulnerability in the phar extension in PHP 5.3 before 5.3.4 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush()

Reference:
http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html

Upstream commit (which was supposed to fix this issue):
http://svn.php.net/viewvc?view=revision&revision=298667
This upstream however commit does not fix phar_stream_flush() case mentioned in MOPS-2010-024.

The issue was however fixed now in:
http://svn.php.net/viewvc?view=revision&revision=302565
and was assigned CVE-2010-2950

Comment 1 Tomas Hoger 2012-06-25 10:24:51 UTC

Related CVE-2010-2094 is tracked via bug #598537.

Comment 2 Tomas Hoger 2012-06-25 10:26:34 UTC

Fixed upstream in 5.3.4:
http://www.php.net/archive/2010.php#id2010-12-10-1

Comment 3 errata-xmlrpc 2012-06-27 15:52:42 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1047 https://rhn.redhat.com/errata/RHSA-2012-1047.html

Comment 4 errata-xmlrpc 2012-06-27 15:53:26 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1046 https://rhn.redhat.com/errata/RHSA-2012-1046.html

Comment 5 Tomas Hoger 2012-06-27 16:09:30 UTC

This issue was originally fixed with CVE-2010-2094 (bug #598537) in PHP 5.3.2 packages that were included in the Red Hat Enterprise Linux 6 in its initial release.  However, PHP was updated to version 5.3.3 in Red Hat Enterprise Linux 6.1 via RHBA-2011:0615:
  https://rhn.redhat.com/errata/RHBA-2011-0615.html

In that update, the fix for this issue was inadvertently removed along with the fix for CVE-2010-2094, which was fixed upstream in 5.3.3.  However, CVE-2010-2950 issue was only fixed upstream in version 5.3.4.  Refer to bug #598537, comment #4 and bug #598537, comment #7 to 10 for more details.