Re: CVE request: PHP MOPS-2010-56..60

[Pierre Joye <pierre.php () gmail com>]

hi,

On Fri, Aug 20, 2010 at 12:17 PM, Tomas Hoger <thoger () redhat com> wrote:
> On Thu, 19 Aug 2010 18:22:29 +0200 pierre.php () gmail com wrote:
>
> > Which one did not get an is? Most of those were actually a single
> > issue.
>
> MOPS-2010-056 - MOPS-2010-060 as subject indicates.  Those are mysqlnd
> issues and session serializer issue allowing data injection.  Not any
> from that set of interruption issues that exposed one or two problems in
> different ways.

As far as I can tell and see, both the mysqlnd and session issues have
been fixed.

Phar: http://svn.php.net/viewvc?view=revision&revision=298667

I don't have the revision at hand for mysqlnd but it is fixed too
(5.3.x and trunk).

About phar, Stefen plans to make yet another blog post about this
flaw, to explain it. We'll see if we managed to fix it... (did I
mention that I love the idea behind responsible disclosure? And I
really love this list too btw :-).

> Has upstream managed to track MOPS-2010-022 down to a proper fix
> already?  That one was not fixed in 5.3.3.  I'm also wondering whether
> the case pointed out in MOPS-2010-024 was not addressed in phar commit
> intentionally.

As far as I remember, the resources related issues are not fixed (-22
and -03), it is also not new and related to the same bug. I also don't
think that it will get fixed any time soon as it is not possible to
fix easily. I think there is already a CVE about this problem.

The phar flaw is fixed (see link).

Please let me know if you need more details, I can try to dig again
the archive to figure them out.

Cheers,
-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org