oss-security - Re: php mb_ereg

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 13 May 2009 14:25:42 +0200
From: Christian Hoffmann <hoffie@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: php mb_ereg_replace()

Heya,

On 2009-05-13 09:40, Sebastian Krahmer wrote:
> anyone aware of Bugtraq ID 34873 (http://www.securityfocus.com/bid/34873)?
> Seems there is no CVE or anything else (not even a patch).
Yes, I've quickly talked to upstream about this on IRC. The outcome was
that this cannot be fixed, both from a technical point of view (escaping
arbitrary multibyte data in a generic way) and from a backward
compatibility point of view (would change behavior).
While I'm far from being confident with that, I definitely see the points.
Related bug: http://bugs.php.net/bug.php?id=48180
A note has been added to the docs, as the bug states, but it doesn't
seem to be live anywhere yet.

I can share the IRC conversation log if the participating persons agree,
I'll quickly ask back.

Regarding CVE... I'm not sure. It is not a vulnerability in PHP. It's a
missing functionality which very very easily leads to severe security
problems in apps which make use of the affected functions. And, this
missing functionality is usually expected to be there, as preg_replace
works like that. So.. tough case, imo.

Hope this helps.

-- 
Christian Hoffmann
Gentoo PHP team

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.