Red Hat Bugzilla – Bug 1377311
CVE-2016-7412 php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field
Last modified: 2018-06-29 18:14:48 EDT
Heap overflow vulnerability was found in mysqlnd which can be triggered by malicious server or MITM by not supplementing UNSIGNED_FLAG in BIT field in php_mysqlnd_rowp_read_text_protocol_aux. Upstream bug: https://bugs.php.net/bug.php?id=72293 Upstream patch: https://github.com/php/php-src/commit/28f80baf3c53e267c9ce46a2a0fadbb981585132?w=1 CVE assignment: http://seclists.org/oss-sec/2016/q3/518
Created php tracking bugs for this issue: Affects: fedora-all [bug 1377366]
Analysis: You need a rogue mysql or a MITM attacker (who is impersonating as a mysql server) to set the correct bits, which causes the overflow on the php side. PHP applications which use databases are usually designed in way, in which the location of the database server (mysql in this case) is hardcoded into the application. The database server is usually administered by the same organization responsible for the PHP application and is therefore assumed to be trusted. Therefore for a typical PHP application, designed as mentioned above, the PHP code will need to be pointed to a rogue/MITM mysql server. This needs some kind of special privileges on the application (for example access to the admin site of the application) or another vulnerability in the affected application. Based on the above, it non-realistic to exploit the above flaw in typical real life PHP applications.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Via RHSA-2018:1296 https://access.redhat.com/errata/RHSA-2018:1296