oss-sec mailing list archives
Re: php header() header injection detection bypass
From: Eygene Ryabinkin <rea-sec () codelabs ru>
Date: Tue, 4 Sep 2012 11:51:16 +0400
Good day. Fri, Aug 31, 2012 at 05:42:14PM -0500, Raphael Geissert wrote:
All the bug reports I mentioned are about exactly the same issue. The non- public ones have been marked as duplicates of the public one. I'm aware of at least 5.4.0 RC5 containing the incomplete fix[1], but I don't know in which exact RC version it made its way into. 5.4.0 beta2 was still vulnerable to CVE-2011-1398. PHP 5.4.1 RC1 already had the proper fix.
As for PHP 5.3/5.2, the three patches are of concern, [1] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/SAPI.c?r1=321634&r2=322263 [2] http://svn.php.net/viewvc/php/php-src/trunk/main/SAPI.c?r1=321634&r2=323033 [3] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=323986&r2=323985&pathrev=323986 First one still has the possibility of injecting '\r' before the first '\n'. The second one kills the protection for the NUL byte check, so it won't allow header splitting for Apache SAPI, but FastCGI stuff will be affected, as per Stefan Esser's assessment, http://thread.gmane.org/gmane.comp.php.devel/70584 Third one fixes the issue. The check for 5.3 tags yields: - 5.3.11, https://github.com/php/php-src/blob/704bbb3263d0ec9a6b4a767bbc516e55388f4b0e/main/SAPI.c#L593 has the issue completely fixed - 5.3.10, https://github.com/php/php-src/blob/e4afa14812d10da7413096c742470fb0582ebc95/main/SAPI.c#L593 has none of the mentioned fixes. The check for 5.2 tags shows that - 5.2.17, https://github.com/php/php-src/blob/dabfd7727f5496ebd913488f6a996117f8597686/main/SAPI.c has none of the mentioned fixes. So, seems like we have the following vulnerable main versions: 5.2.0 <= php < 5.3.11, 5.4.0 <= php < 5.4.1. -- Eygene
Current thread:
- php header() header injection detection bypass Raphael Geissert (Aug 29)
- Re: php header() header injection detection bypass Kurt Seifried (Aug 31)
- Re: php header() header injection detection bypass Raphael Geissert (Aug 31)
- Re: php header() header injection detection bypass Kurt Seifried (Sep 01)
- Re: php header() header injection detection bypass Eygene Ryabinkin (Sep 04)
- Re: php header() header injection detection bypass cve-assign (Sep 04)
- Re: Re: php header() header injection detection bypass Raphael Geissert (Sep 04)
- Re: php header() header injection detection bypass cve-assign (Sep 05)
- Re: Re: php header() header injection detection bypass Raphael Geissert (Sep 06)
- Re: php header() header injection detection bypass Raphael Geissert (Aug 31)
- Re: Re: php header() header injection detection bypass Eygene Ryabinkin (Sep 04)
- Re: php header() header injection detection bypass Kurt Seifried (Aug 31)