Originally the CVE identifier of CVE-2011-1398 has been assigned by Common Vulnerabilities and Exposures to the following security flaw: The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 does not properly handle %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. It was reported that the original upstream patch would not completely address the CVE-2011-1398 issue: [1] http://www.openwall.com/lists/oss-security/2012/08/29/5 The CVE identifier of CVE-2012-4388 has been assigned to the incomplete fix: [2] http://www.openwall.com/lists/oss-security/2012/09/02/1 Final upstream patch: [3] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986
Further CVE-2012-4388 affected versions clarification from Eygene Ryabinkin (http://www.openwall.com/lists/oss-security/2012/09/04/1): ---------------------------------------------------------- Fri, Aug 31, 2012 at 05:42:14PM -0500, Raphael Geissert wrote: > All the bug reports I mentioned are about exactly the same issue. The non- > public ones have been marked as duplicates of the public one. > > I'm aware of at least 5.4.0 RC5 containing the incomplete fix[1], but I don't > know in which exact RC version it made its way into. 5.4.0 beta2 was still > vulnerable to CVE-2011-1398. > > PHP 5.4.1 RC1 already had the proper fix. As for PHP 5.3/5.2, the three patches are of concern, [1] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/SAPI.c?r1=321634&r2=322263 [2] http://svn.php.net/viewvc/php/php-src/trunk/main/SAPI.c?r1=321634&r2=323033 [3] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986 First one still has the possibility of injecting '\r' before the first '\n'. The second one kills the protection for the NUL byte check, so it won't allow header splitting for Apache SAPI, but FastCGI stuff will be affected, as per Stefan Esser's assessment, http://thread.gmane.org/gmane.comp.php.devel/70584 Third one fixes the issue. The check for 5.3 tags yields: - 5.3.11, https://github.com/php/php-src/blob/704bbb3263d0ec9a6b4a767bbc516e55388f4b0e/main/SAPI.c#L593 has the issue completely fixed - 5.3.10, https://github.com/php/php-src/blob/e4afa14812d10da7413096c742470fb0582ebc95/main/SAPI.c#L593 has none of the mentioned fixes. The check for 5.2 tags shows that - 5.2.17, https://github.com/php/php-src/blob/dabfd7727f5496ebd913488f6a996117f8597686/main/SAPI.c has none of the mentioned fixes. So, seems like we have the following vulnerable main versions: 5.2.0 <= php < 5.3.11, 5.4.0 <= php < 5.4.1. -- Eygene
This issue did NOT affect the versions of the php package, as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include the upstream commit 322263 that introduced this issue. -- This issue did NOT affect the version of the php53 package, as shipped with Red Hat Enterprise Linux 5 as it did not include the upstream commit 322263 that introduced this issue. -- This issue did NOT affect the versions of the php package, as shipped with Fedora release of 16 and 17.
Statement: Not vulnerable. This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5 and 6, and the version of php53 as shipped with Red Hat Enterprise Linux 5 as they did not include the upstream commit 322263 that introduced this issue.