Red Hat Bugzilla – Bug 519266
CVE-2008-7068 php: dba_replace() file corruption vulnerability
Last modified: 2009-08-27 04:02:22 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7068 to the following vulnerability: Name: CVE-2008-7068 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7068 Assigned: 20090824 Reference: SREASONRES:20081127 PHP 5.2.6 dba_replace() destroying file Reference: URL: http://securityreason.com/achievement_securityalert/58 Reference: BUGTRAQ:20081127 SecurityReason : PHP 5.2.6 dba_replace() destroying file Reference: URL: http://www.securityfocus.com/archive/1/archive/1/498746/100/0/threaded Reference: BUGTRAQ:20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file Reference: URL: http://www.securityfocus.com/archive/1/498981/100/0/threaded Reference: BUGTRAQ:20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file Reference: URL: http://www.securityfocus.com/archive/1/498982/100/0/threaded Reference: CONFIRM: http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313&r2=1.2027.2.547.2.1314& Reference: OSVDB:52206 Reference: URL: http://www.osvdb.org/52206 Reference: XF:php-dbareplace-file-corruption(47316) Reference: URL: http://xforce.iss.net/xforce/xfdb/47316 The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.
This is not a security issue. A user with read and write access to a file can reasonably be expected to manipulate the contents of the file, including truncating it. Instead of using dba_replace(), a user could simply fopen() the file in write mode and write an empty string to it, which provides the same end-result.
For posterity, the patch to fix this issue is here: http://cvs.php.net/viewvc.cgi/php-src/ext/dba/libinifile/inifile.c?r1=1.14.2.1.2.4&r2=1.14.2.1.2.5&view=patch
Further discussion about the issue: http://thread.gmane.org/gmane.comp.security.oss.general/1438