Bug 670811 (CVE-2010-4700) - CVE-2010-4700 php: mysqli mysqli_fetch_assoc does not escape its output when magic_quotes are enabled
Summary: CVE-2010-4700 php: mysqli mysqli_fetch_assoc does not escape its output when ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2010-4700
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-01-19 13:11 UTC by Tomas Hoger
Modified: 2021-02-24 16:45 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2011-01-21 14:28:58 UTC
Embargoed:


Attachments (Terms of Use)

Description Tomas Hoger 2011-01-19 13:11:32 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4700 to the following issue:

The set_magic_quotes_runtime function in PHP 5.3.2 and 5.3.3, when the
MySQLi extension is used, does not properly interact with use of the
mysqli_fetch_assoc function, which might make it easier for
context-dependent attackers to conduct SQL injection attacks via
crafted input that had been properly handled in earlier PHP versions.

References:
http://bugs.php.net/52221
http://www.php.net/ChangeLog-5.php#5.3.4

Upstream commit:
http://svn.php.net/viewvc/?view=revision&revision=302776

Comment 2 Tomas Hoger 2011-01-20 20:38:10 UTC
I can't reproduce this issue on RHEL PHP 5.3.2 and 5.3.3.  The output is escaped as expected, identical to the file_get_contents("test.txt") output.

Looking at what code is touched by the patches referenced above, it's #ifdef MYSQLI_USE_MYSQLND code.  Both RHEL and Fedora PHP packages still use libmysql, rather than new mysqlnd driver.  Our builds should not be affected by this issue.

Comment 3 Tomas Hoger 2011-01-20 20:47:34 UTC
Fedora RFE for switch to mysqlnd - bug #510951.

Comment 5 Joe Orton 2011-01-21 14:16:23 UTC
Tomas is correct that this only affects the build with mysqlnd enabled, which we don't ship.

Comment 6 Tomas Hoger 2011-01-21 14:28:58 UTC
Statement:

Not vulnerable. This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 4, 5, or 6.


Note You need to log in before you can comment on or make changes to this bug.