oss-security - Re: Re: CVE Request

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 17 Dec 2008 21:27:44 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re:  Re: CVE Request - roundcubemail

* Steven M. Christey:

> The general issue of /e in preg_replace is covered by CWE-624 Executable
> Regular Expression Error (http://cwe.mitre.org/data/definitions/624.html)
> which has a couple other CVE examples.

Thanks for the reference.

> I bet there's a chunk of these in various applications.  I believe Perl
> has similar functionality.

Not quite, the s///e operator uses a compile-time transformation for
the replacement expression, so it shouldn't be affected by this very
issue.

\Q \E pairs are an issue in the pattern, not the replacement.
Mistakes in this area increase the attack surface by exposing the
regular expression compiler to potentially hostile input, and it may
lead to denial-of-service vulnerabilities because some implementations
do not cope well with certain patterns.  Perhaps CWE-624 should be
split to reflect this?

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.