oss-sec mailing list archives
Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8
From: Pierre Joye <pierre.php () gmail com>
Date: Sun, 25 Sep 2011 11:02:17 +0200
hi Stas, I tend to disagree here. One of the CVE goal is not about declaring one or the other guilty of bad practice(s) but about informing users about security issues in the software they use and how to act correctly to fix these issues. The is_a change is typically one of these security issues. While being a minor one (recommended ini settings or good code practices would avoid it easily), it is still one. That's why I'd to go with assigning one and link it to the bug. On Sun, Sep 25, 2011 at 10:56 AM, Stas Malyshev <smalyshev () sugarcrm com> wrote:
Yes, it is a behavior change, and it shouldn't have happened in 5.3, the fact that it happened was a bad mistake, it is clear now. However, the security flaw is squarely in the code that a) misuses is_a b) doesn't have security checks and c) does not follow recommended best practices about PHP settings. As such, telling people that it was a flaw in PHP and that BC break reversal "fixed" it only gives them wrong ideas that their code was just fine. But in fact their code was broken and only by luck (and due to the haphazard way things were done in PHP where nobody bothered correlating function signatures with one another) in might have not been malfunctioning in this specific scenario. They need to fix that code ASAP, as they can not rely on luck anymore and they way is_a was changed is actually they way it should have worked from the start and the way is_subclass_of works right now.
-- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org
Current thread:
- CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Vincent Danen (Sep 24)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Stas Malyshev (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Pierre Joye (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Stas Malyshev (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Pierre Joye (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Stas Malyshev (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Pierre Joye (Sep 25)
- RE: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Zeev Suraski (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Pierre Joye (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Rasmus Lerdorf (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Pierre Joye (Sep 25)
- Re: Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Vincent Danen (Sep 26)
- Re: Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Johannes Schlüter (Sep 26)
- Re: Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Pierre Joye (Sep 26)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Pierre Joye (Sep 25)
- Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8 Stas Malyshev (Sep 25)