Bug 1151423 (CVE-2014-3622) - CVE-2014-3622 php: post handler potential illegal efree() vulnerability
Summary: CVE-2014-3622 php: post handler potential illegal efree() vulnerability
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-3622
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1149063 1151427
TreeView+ depends on / blocked
 
Reported: 2014-10-10 11:22 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:23 UTC (History)
18 users (show)

Fixed In Version: php 5.6.1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-10-21 10:43:37 UTC


Attachments (Terms of Use)

Description Vasyl Kaigorodov 2014-10-10 11:22:15 UTC
It was found [1] that there's an issue in php which in some cases may lead to remote code execution.

[1]: https://bugs.php.net/bug.php?id=68088

Comment 1 Remi Collet 2014-10-10 11:34:20 UTC
As this require an extension doing bad things to be installed and enabled on the server side, I really think this is not a security issue (or a very very low one)

Comment 2 Vasyl Kaigorodov 2014-10-15 15:22:59 UTC
(In reply to Remi Collet from comment #1)
> As this require an extension doing bad things to be installed and enabled on
> the server side, I really think this is not a security issue (or a very very
> low one)

This one got a CVE, and that CVE got a CAT I IAVM: http://iasecontent.disa.mil/stigs/xls/iavm-to-cve%28u%29.xls

But you're right, reading the PHP bug:
...
However currently I am not aware of anything using input filters except for ext/filter and suhosin. Both are not doing anything to the value. But if there is some 3rd party possibly binary only filter extension out there that modifies
value it might result in a remotely exploitable problem for PHP 5.6+.
...

Setting Impact to Low.

Comment 3 Tomas Hoger 2014-10-21 10:43:37 UTC
Note that this is not really considered security flaw upstream (upstream bug type was changed from Security to Bug).  This can only be a problem if a filter extension attempts to free value passed to it.  No extensions are known to do that.

This issue was introduced upstream in the following commit:

http://git.php.net/?p=php-src.git;a=commitdiff;h=2438490#patch10

Prior to the above change, value was estrndup()ed before being passed to input filters.  Re-introduction of estrndup() is how the issue was fixed upstream:

http://git.php.net/?p=php-src.git;a=commitdiff;h=8d1099a

This change was applied in PHP version 5.6.1:

http://php.net/ChangeLog-5.php#5.6.1

Only PHP 5.6 versions were affected.  No Red Hat product currently ships PHP 5.6.  Older versions included in Red Hat products were not affected.

Statement:

Not vulnerable. This issue did not affect the versions of PHP as shipped with Red Hat Enterprise Linux 5, 6, and 7, and Red Hat Software Collections 1.

Comment 6 Tomas Hoger 2014-10-21 10:48:58 UTC
Released Fedora versions (up to 20 at the moment) also contain PHP 5.5.  Version 5.6 is only included in Rawhide / upcoming F21, and is already updated to 5.6.1.


Note You need to log in before you can comment on or make changes to this bug.