oss-sec mailing list archives
Re: CVE request: php 5.2.6 ext/imap buffer overflows
From: Christian Hoffmann <hoffie () gentoo org>
Date: Tue, 24 Jun 2008 11:39:19 +0200
On 2008-06-23 21:20, Steven M. Christey wrote:
====================================================== Name: CVE-2008-2829 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2829 Reference: MISC:http://bugs.php.net/bug.php?id=42862 Reference: CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=221969 Reference: MLIST:[oss-security] 20080619 CVE request: php 5.2.6 ext/imap buffer overflows Reference: URL:http://www.openwall.com/lists/oss-security/2008/06/19/6 php_imap.c in PHP 5.2.5, 5.2.6, 4.x, and other versions, uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) via a long IMAP request, which triggers an "rfc822.c legacy routine buffer overflow" error message.
Thanks. I do not have a deeper understanding of the issue in question, but the upstream bug report at bugs.php.net quotes a mail from a c-client developer, which says that the abort() will most likely not catch all possible buffer overflows, and as such allow for the buffer to overflow. So, according to the information from the bug, this issue might not only allow for DoS but possibly for code execution as well, at least this is what it looks like to me. Maybe you did further investigation and found it to be exploitable as a DoS only, but if this is not the case the description of the CVE entry should be clarified, in my opinion.
Also, I'm not quote sure why you are explicitily mentioning 5.2.5. To me it looks like all versions of php are affected, so in my opinion this looks a bit confusing. Only a cosmetic thing though.
-- Christian Hoffmann
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- CVE request: php 5.2.6 ext/imap buffer overflows Christian Hoffmann (Jun 19)
- Re: CVE request: php 5.2.6 ext/imap buffer overflows Steven M. Christey (Jun 23)
- Re: CVE request: php 5.2.6 ext/imap buffer overflows Christian Hoffmann (Jun 24)
- Re: CVE request: php 5.2.6 ext/imap buffer overflows Steven M. Christey (Jun 23)