Bug 718253 – CVE-2011-1657 php: ZipArchive::addGlob() missing glob flags filtering

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 718253 - (CVE-2011-1657) CVE-2011-1657 php: ZipArchive::addGlob() missing glob flags filtering

Summary:	CVE-2011-1657 php: ZipArchive::addGlob() missing glob flags filtering

Status:	CLOSED DUPLICATE of bug 169857

Aliases:	CVE-2011-1657

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	unspecified Severity unspecified
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=none,public=20110507,reported=...
Keywords:	Security

Depends On:
Blocks:	713201
	Show dependency tree / graph

Reported:	2011-07-01 11:12 EDT by Tomas Hoger
Modified:	2015-08-19 05:11 EDT (History)
CC List:	1 user (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2011-07-01 11:22:00 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Tomas Hoger 2011-07-01 11:12:22 EDT

Maksymilian Arciemowicz reported that PHP's (currently undocumented) ZipArchive::addGlob() does not sanitize flags argument before passing it to underlying libc's glob(3) function. When this function is called with specially crafted argument, this issue can trigger a crash in glob(). On Linux/glibc, this can be reproduced by using flags as GLOB_APPEND or GLOB_ALTDIRFUNC, which require certain setup of the glob_t structure before glob() is called.

Upstream bug report and commit:
https://bugs.php.net/bug.php?id=54681
http://svn.php.net/viewvc/?view=revision&revision=310814

Comment 3 Tomas Hoger 2011-07-01 11:22:00 EDT

This is under the full control of the script author, hence may possibly allow
safe_mode / open_basedir restrictions.

*** This bug has been marked as a duplicate of bug 169857 ***

Comment 4 Tomas Hoger 2011-07-01 11:22:53 EDT

Statement:

We do not consider safe_mode / open_basedir restriction bypass issues to be security sensitive.  For more details see https://bugzilla.redhat.com/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php

Note You need to log in before you can comment on or make changes to this bug.