Bug 854184 (CVE-2012-4388)

Summary:	CVE-2012-4388 php: header() injection detection bypass (incorrect fix for CVE-2011-1398)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-09-04 09:33:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2012-09-04 09:23:33 UTC

Originally the CVE identifier of CVE-2011-1398 has been assigned by Common Vulnerabilities and Exposures to the following security flaw:

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 does not properly handle %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.

It was reported that the original upstream patch would not completely address the CVE-2011-1398 issue:
[1] http://www.openwall.com/lists/oss-security/2012/08/29/5

The CVE identifier of CVE-2012-4388 has been assigned to the incomplete fix:
[2] http://www.openwall.com/lists/oss-security/2012/09/02/1

Final upstream patch:
[3] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986

Comment 1 Jan Lieskovsky 2012-09-04 09:25:32 UTC

Further CVE-2012-4388 affected versions clarification from Eygene Ryabinkin
(http://www.openwall.com/lists/oss-security/2012/09/04/1):
----------------------------------------------------------

Fri, Aug 31, 2012 at 05:42:14PM -0500, Raphael Geissert wrote:
> All the bug reports I mentioned are about exactly the same issue. The non-
> public ones have been marked as duplicates of the public one.
> 
> I'm aware of at least 5.4.0 RC5 containing the incomplete fix[1], but I don't 
> know in which exact RC version it made its way into. 5.4.0 beta2 was still 
> vulnerable to CVE-2011-1398.
> 
> PHP 5.4.1 RC1 already had the proper fix.

As for PHP 5.3/5.2, the three patches are of concern,
 [1] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/SAPI.c?r1=321634&r2=322263
 [2] http://svn.php.net/viewvc/php/php-src/trunk/main/SAPI.c?r1=321634&r2=323033
 [3] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986

First one still has the possibility of injecting '\r' before the first '\n'.
The second one kills the protection for the NUL byte check, so it won't
allow header splitting for Apache SAPI, but FastCGI stuff will be affected,
as per Stefan Esser's assessment,
  http://thread.gmane.org/gmane.comp.php.devel/70584
Third one fixes the issue.

The check for 5.3 tags yields:
 - 5.3.11, https://github.com/php/php-src/blob/704bbb3263d0ec9a6b4a767bbc516e55388f4b0e/main/SAPI.c#L593
   has the issue completely fixed
 - 5.3.10, https://github.com/php/php-src/blob/e4afa14812d10da7413096c742470fb0582ebc95/main/SAPI.c#L593
   has none of the mentioned fixes.

The check for 5.2 tags shows that
 - 5.2.17, https://github.com/php/php-src/blob/dabfd7727f5496ebd913488f6a996117f8597686/main/SAPI.c
   has none of the mentioned fixes.

So, seems like we have the following vulnerable main versions:
  5.2.0 <= php < 5.3.11, 5.4.0 <= php < 5.4.1.
-- 
Eygene

Comment 2 Jan Lieskovsky 2012-09-04 09:31:11 UTC

This issue did NOT affect the versions of the php package, as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include the upstream commit 322263 that introduced this issue.

--

This issue did NOT affect the version of the php53 package, as shipped with Red Hat Enterprise Linux 5 as it did not include the upstream commit 322263 that introduced this issue.

--

This issue did NOT affect the versions of the php package, as shipped with Fedora release of 16 and 17.

Comment 3 Jan Lieskovsky 2012-09-04 09:33:04 UTC

Statement:

Not vulnerable. This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5 and 6, and the version of php53 as shipped with Red Hat Enterprise Linux 5 as they did not include the upstream commit 322263 that introduced this issue.