Bug 820874 - (CVE-2012-2335) CVE-2012-2335 php: incomplete CVE-2012-1823 fix - insecure wrapper
CVE-2012-2335 php: incomplete CVE-2012-1823 fix - insecure wrapper
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20120503,reported=2...
: Security
Depends On:
Blocks: 820710
  Show dependency treegraph
 
Reported: 2012-05-11 05:19 EDT by Tomas Hoger
Modified: 2015-04-16 04:24 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-27 12:17:35 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2012-05-11 05:19:22 EDT
A CVE-2012-1823 was assigned to a PHP-CGI flaw that could allow remote attackers to execute arbitrary code by injecting php-cgi command line arguments via specially crafted query string.  Refer to bug #818607 for details about this flaw.

The released fix for this issue was reported to be incomplete and can be bypassed by prefixing the query string with spaces (e.g. ?+-s).  However, that problem only affected configurations where insecure wrapper script similar to the one pointed out in the CVE-2012-1823 reporter's blog post:

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
http://www.php.net/archive/2012.php#id2012-05-06-1
http://wiki.dreamhost.com/PHP.ini#Create_the_script_wrapper

While this problem is not a PHP flaw, it was mitigated in the upstream PHP versions 5.3.13 and 5.4.3 by skipping leading spaces in the query string before performing CVE-2012-1823 check:

http://git.php.net/?p=php-src.git;a=commitdiff;h=000e84aa88ce16deabbf61e7086fc8db63ca88aa

Red Hat PHP packages updates released to correct the CVE-2012-1823 issue do not include this mitigation.  Refer to bug #818607, comment #31 for information on how to correct such unsafe wrapper scripts.  Future Red Hat PHP packages updates may include this mitigation.
Comment 1 Tomas Hoger 2012-05-11 06:25:28 EDT
Mitre CVE description:

php-wrapper.fcgi does not properly handle command-line arguments,
which allows remote attackers to bypass a protection mechanism in PHP
5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper
interaction between the PHP sapi/cgi/cgi_main.c component and a query
string beginning with a +- sequence.

As mentioned above, this CVE is for insecure wrapper rather than PHP.
Comment 2 Tomas Hoger 2012-06-27 12:17:35 EDT
(In reply to comment #0)
> Red Hat PHP packages updates released to correct the CVE-2012-1823 issue do
> not include this mitigation.  Refer to bug #818607, comment #31 for
> information on how to correct such unsafe wrapper scripts.  Future Red Hat
> PHP packages updates may include this mitigation.

This mitigation is now included in the following PHP packages updates for Red Hat Enterprise Linux 5 and 6, which also address CVE-2012-2336 (bug #820708):

https://rhn.redhat.com/errata/RHSA-2012-1045.html
https://rhn.redhat.com/errata/RHSA-2012-1046.html
https://rhn.redhat.com/errata/RHSA-2012-1047.html
Comment 3 Martin Prpic 2015-04-16 04:24:10 EDT
Statement:

The mitigation for CVE-2012-2335 is included in the following PHP updates for Red Hat Enterprise Linux 5 and 6, which also address CVE-2012-2336 (BZ#820708):

https://rhn.redhat.com/errata/RHSA-2012-1045.html
https://rhn.redhat.com/errata/RHSA-2012-1046.html
https://rhn.redhat.com/errata/RHSA-2012-1047.html

Note You need to log in before you can comment on or make changes to this bug.