[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0905131045320.304@faron.mitre.org>
Date: Wed, 13 May 2009 10:47:01 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: php mb_ereg_replace()
On Wed, 13 May 2009, Christian Hoffmann wrote:
> Regarding CVE... I'm not sure. It is not a vulnerability in PHP. It's a
> missing functionality which very very easily leads to severe security
> problems in apps which make use of the affected functions. And, this
> missing functionality is usually expected to be there, as preg_replace
> works like that. So.. tough case, imo.
We don't have a CVE for the fact that strcpy() exists - it can be used
safely even though it's dangerous. My interpretation of this issue was
the same, so no CVE is needed. Any PHP application that misuses
mb_ereg_replace(), however, is fair game.
(We already have a handful of CVEs for executable regexp's in PHP apps)
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
