Bug 718253 (CVE-2011-1657) - CVE-2011-1657 php: ZipArchive::addGlob() missing glob flags filtering
Summary: CVE-2011-1657 php: ZipArchive::addGlob() missing glob flags filtering
Status: CLOSED DUPLICATE of bug 169857
Alias: CVE-2011-1657
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
Blocks: 713201
TreeView+ depends on / blocked
Reported: 2011-07-01 15:12 UTC by Tomas Hoger
Modified: 2021-02-24 15:08 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2011-07-01 15:22:00 UTC

Attachments (Terms of Use)

Description Tomas Hoger 2011-07-01 15:12:22 UTC
Maksymilian Arciemowicz reported that PHP's (currently undocumented) ZipArchive::addGlob() does not sanitize flags argument before passing it to underlying libc's glob(3) function. When this function is called with specially crafted argument, this issue can trigger a crash in glob(). On Linux/glibc, this can be reproduced by using flags as GLOB_APPEND or GLOB_ALTDIRFUNC, which require certain setup of the glob_t structure before glob() is called.

Upstream bug report and commit:

Comment 3 Tomas Hoger 2011-07-01 15:22:00 UTC
This is under the full control of the script author, hence may possibly allow
safe_mode / open_basedir restrictions.

*** This bug has been marked as a duplicate of bug 169857 ***

Comment 4 Tomas Hoger 2011-07-01 15:22:53 UTC

We do not consider safe_mode / open_basedir restriction bypass issues to be security sensitive.  For more details see https://bugzilla.redhat.com/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php

Note You need to log in before you can comment on or make changes to this bug.