Bug 854184 - (CVE-2012-4388) CVE-2012-4388 php: header() injection detection bypass (incorrect fix for CVE-2011-1398)
CVE-2012-4388 php: header() injection detection bypass (incorrect fix for CVE...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120902,repor...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-09-04 05:23 EDT by Jan Lieskovsky
Modified: 2015-07-31 02:53 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-09-04 05:33:04 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-09-04 05:23:33 EDT
Originally the CVE identifier of CVE-2011-1398 has been assigned by Common Vulnerabilities and Exposures to the following security flaw:

The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 does not properly handle %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.

It was reported that the original upstream patch would not completely address the CVE-2011-1398 issue:
[1] http://www.openwall.com/lists/oss-security/2012/08/29/5

The CVE identifier of CVE-2012-4388 has been assigned to the incomplete fix:
[2] http://www.openwall.com/lists/oss-security/2012/09/02/1

Final upstream patch:
[3] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986
Comment 1 Jan Lieskovsky 2012-09-04 05:25:32 EDT
Further CVE-2012-4388 affected versions clarification from Eygene Ryabinkin
(http://www.openwall.com/lists/oss-security/2012/09/04/1):
----------------------------------------------------------

Fri, Aug 31, 2012 at 05:42:14PM -0500, Raphael Geissert wrote:
> All the bug reports I mentioned are about exactly the same issue. The non-
> public ones have been marked as duplicates of the public one.
> 
> I'm aware of at least 5.4.0 RC5 containing the incomplete fix[1], but I don't 
> know in which exact RC version it made its way into. 5.4.0 beta2 was still 
> vulnerable to CVE-2011-1398.
> 
> PHP 5.4.1 RC1 already had the proper fix.

As for PHP 5.3/5.2, the three patches are of concern,
 [1] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/SAPI.c?r1=321634&r2=322263
 [2] http://svn.php.net/viewvc/php/php-src/trunk/main/SAPI.c?r1=321634&r2=323033
 [3] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986

First one still has the possibility of injecting '\r' before the first '\n'.
The second one kills the protection for the NUL byte check, so it won't
allow header splitting for Apache SAPI, but FastCGI stuff will be affected,
as per Stefan Esser's assessment,
  http://thread.gmane.org/gmane.comp.php.devel/70584
Third one fixes the issue.

The check for 5.3 tags yields:
 - 5.3.11, https://github.com/php/php-src/blob/704bbb3263d0ec9a6b4a767bbc516e55388f4b0e/main/SAPI.c#L593
   has the issue completely fixed
 - 5.3.10, https://github.com/php/php-src/blob/e4afa14812d10da7413096c742470fb0582ebc95/main/SAPI.c#L593
   has none of the mentioned fixes.

The check for 5.2 tags shows that
 - 5.2.17, https://github.com/php/php-src/blob/dabfd7727f5496ebd913488f6a996117f8597686/main/SAPI.c
   has none of the mentioned fixes.

So, seems like we have the following vulnerable main versions:
  5.2.0 <= php < 5.3.11, 5.4.0 <= php < 5.4.1.
-- 
Eygene
Comment 2 Jan Lieskovsky 2012-09-04 05:31:11 EDT
This issue did NOT affect the versions of the php package, as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include the upstream commit 322263 that introduced this issue.

--

This issue did NOT affect the version of the php53 package, as shipped with Red Hat Enterprise Linux 5 as it did not include the upstream commit 322263 that introduced this issue.

--

This issue did NOT affect the versions of the php package, as shipped with Fedora release of 16 and 17.
Comment 3 Jan Lieskovsky 2012-09-04 05:33:04 EDT
Statement:

Not vulnerable. This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5 and 6, and the version of php53 as shipped with Red Hat Enterprise Linux 5 as they did not include the upstream commit 322263 that introduced this issue.

Note You need to log in before you can comment on or make changes to this bug.