Bug 1035670 (CVE-2013-6712) - CVE-2013-6712 php: heap-based buffer over-read in DateInterval
Summary: CVE-2013-6712 php: heap-based buffer over-read in DateInterval
Status: CLOSED ERRATA
Alias: CVE-2013-6712
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20131127,reported=2...
Keywords: Security
Depends On: 1067550 1067553 1114521 1119563 1120503 1120504 1149762
Blocks: 1035675 1065838 1149858
TreeView+ depends on / blocked
 
Reported: 2013-11-28 09:43 UTC by Ratul Gupta
Modified: 2015-10-15 18:07 UTC (History)
20 users (show)

Fixed In Version: php 5.4.24, php 5.5.8
Doc Type: Bug Fix
Doc Text:
A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-10-31 09:07:00 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1012 normal SHIPPED_LIVE Moderate: php53 and php security update 2014-08-06 09:14:44 UTC
Red Hat Product Errata RHSA-2014:1765 normal SHIPPED_LIVE Important: php54-php security update 2014-10-30 23:45:24 UTC

Description Ratul Gupta 2013-11-28 09:43:08 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-6712 to the following vulnerability:

The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

Upstream bug:
https://bugs.php.net/bug.php?id=66060

Upstream fix:
http://git.php.net/?p=php-src.git;a=commit;h=12fe4e90be7bfa2a763197079f68f5568a14e071

Comment 3 Vincent Danen 2013-12-10 21:16:15 UTC
This issue affects PHP 5.3, 5.4, and 5.5.

Comment 5 Tomas Hoger 2014-02-20 15:26:00 UTC
Fixed upstream in 5.4.24 and 5.5.8:
http://www.php.net/ChangeLog-5.php#5.4.24
http://www.php.net/ChangeLog-5.php#5.5.8

Comment 6 Tomas Hoger 2014-02-20 15:57:19 UTC
This issue can cause PHP to over-read heap-based buffer when parsing specially-crafted interval specification using the DateInterval class.  It may possibly lead to leak of portions of heap memory, or interpreter crash.  This greatly depends on the contents of memory behind the buffer being over-read.  Actual crash was only reproducible with special builds with address sanitizer.

Statement:

This issue did not affect the php packages as shipped with Red Hat Enterprise Linux 5. This issue did not affect the php packages as shipped with Red Hat Enterprise Linux 7.

Comment 8 Tomas Hoger 2014-02-20 16:02:04 UTC
Fedora php packages are already updated to 5.5.8 or later and are no longer affected by this issue.

Comment 10 Tomas Hoger 2014-02-20 17:43:59 UTC
(In reply to Tomas Hoger from comment #6)
> It may possibly lead to leak of portions of heap memory, or interpreter crash.

I was wrong about information leak.  There are check later in the code, that make php generate warning / exception if this error occurs, rather than creating DateInterval instance populated with leaked data.

Comment 15 Martin Prpič 2014-07-28 11:13:02 UTC
IssueDescription:

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash.

Comment 17 errata-xmlrpc 2014-08-06 05:15:12 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:1012 https://rhn.redhat.com/errata/RHSA-2014-1012.html

Comment 19 errata-xmlrpc 2014-10-30 19:47:18 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html


Note You need to log in before you can comment on or make changes to this bug.