Bug 1789069 (CVE-2019-11044) - CVE-2019-11044 php: link function accepts filenames with embedded null byte and treats them as terminating at that byte on Windows
Summary: CVE-2019-11044 php: link function accepts filenames with embedded null byte a...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-11044
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1789070
TreeView+ depends on / blocked
 
Reported: 2020-01-08 16:46 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-03-24 16:40 UTC (History)
5 users (show)

Fixed In Version: php 7.3.14RC1
Clone Of:
Environment:
Last Closed: 2020-01-15 14:09:26 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-01-08 16:46:30 UTC 
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference:
https://bugs.php.net/bug.php?id=78862
Comment 1 Riccardo Schirone 2020-01-15 08:57:16 UTC 
Upstream fix:
https://github.com/php/php-src/commit/0e6c0654ed06751ced134515f7629c40bd979d7f
Comment 2 Riccardo Schirone 2020-01-15 10:43:39 UTC 
This flaw is present in the file ext/standard/link_win32.c, which is compiled only on Windows builds.

Similar code is present in ext/standard/link.c and there was a similar flaw there in the past, named CVE-2006-7243. This was however fixed in the versions of php we ship.
Comment 3 Riccardo Schirone 2020-01-15 10:47:02 UTC 
Statement:

This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as the flaw only affects Windows builds. See CVE-2006-7243 for the Linux version of this flaw.
Comment 4 Product Security DevOps Team 2020-01-15 14:09:26 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11044
Note You need to log in before you can comment on or make changes to this bug.