Re: php mb_ereg_replace()

[Christian Hoffmann <hoffie () gentoo org>]

Heya,

On 2009-05-13 09:40, Sebastian Krahmer wrote:
> anyone aware of Bugtraq ID 34873 (http://www.securityfocus.com/bid/34873)?
> Seems there is no CVE or anything else (not even a patch).
Yes, I've quickly talked to upstream about this on IRC. The outcome was
that this cannot be fixed, both from a technical point of view (escaping
arbitrary multibyte data in a generic way) and from a backward
compatibility point of view (would change behavior).
While I'm far from being confident with that, I definitely see the points.
Related bug: http://bugs.php.net/bug.php?id=48180
A note has been added to the docs, as the bug states, but it doesn't
seem to be live anywhere yet.

I can share the IRC conversation log if the participating persons agree,
I'll quickly ask back.

Regarding CVE... I'm not sure. It is not a vulnerability in PHP. It's a
missing functionality which very very easily leads to severe security
problems in apps which make use of the affected functions. And, this
missing functionality is usually expected to be there, as preg_replace
works like that. So.. tough case, imo.

Hope this helps.

-- 
Christian Hoffmann
Gentoo PHP team

Attachment: signature.asc
Description: OpenPGP digital signature