Bug 969996 (CVE-2013-3735)

Summary: CVE-2013-3735 php: DoS (memory exhaustion, application crash) via crafted function definition
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: fedora, jorton, rpm, webstack-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-06-04 04:49:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 970004    

Description Jan Lieskovsky 2013-06-03 09:37:38 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-3735 to the following vulnerability:

** DISPUTED ** The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment.  NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id."

References:
[1] https://bugs.php.net/bug.php?id=64660
[2] https://github.com/php/php-src/blob/php-5.4.16RC1/NEWS
[3] https://github.com/php/php-src/blob/php-5.5.0RC2/NEWS
[4] https://github.com/php/php-src/commit/fb58e69a84f4fde603a630d2c9df2fa3be16d846
Comment 4 Huzaifa S. Sidhpurwala 2013-06-04 04:49:55 UTC 
Statement:

We do not consider memory safety hazards caused by malformed php scripts as a security issue. Also (as per upstream) OS-level security should be used to protect systems from memory exhaustion caused by php applications.