oss-security - Re: CVE-2010-2094: PECL's phar code is vulnerable too

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTimAWN8gB3DZrHN_4qappYdOM0PzZjjiF+0EZqSz@mail.gmail.com>
Date: Sun, 26 Dec 2010 10:29:27 -0200
From: Felipe Pena <felipensp@...il.com>
To: Eygene Ryabinkin <rea-sec@...elabs.ru>
Cc: oss-security@...ts.openwall.com, kalle@....net, felipe@....net, 
	cellog@....net, pajoye@....net
Subject: Re: CVE-2010-2094: PECL's phar code is vulnerable too

Hi Eygene,

2010/12/26 Eygene Ryabinkin <rea-sec@...elabs.ru>

> Good day.
>
> It turns out that the PECL's phar extension is vulnerable to the
> string format vulnerabilities announced in MOPS advisories:
>  MOPS-2010-024:
> http://svn.php.net/viewvc/pecl/phar/trunk/stream.c?revision=286339&view=markup#l473
>  MOPS-2010-025:
> http://svn.php.net/viewvc/pecl/phar/trunk/dirstream.c?revision=284729&view=markup#l363
>  MOPS-2010-026:
> http://svn.php.net/viewvc/pecl/phar/trunk/stream.c?revision=286339&view=markup#l764
>  MOPS-2010-027:
> http://svn.php.net/viewvc/pecl/phar/trunk/stream.c?revision=286339&view=markup#l120
> ,
>
> http://svn.php.net/viewvc/pecl/phar/trunk/stream.c?revision=286339&view=markup#l131
> ,
>
> http://svn.php.net/viewvc/pecl/phar/trunk/stream.c?revision=286339&view=markup#l143
>  MOPS-2010-028:
> http://svn.php.net/viewvc/pecl/phar/trunk/stream.c?revision=286339&view=markup#l195
>
> I think that the entry should be extended.  Don't know if PECL
> code is going to be fixed.  CC'ing PHP developers who were last
> to modify PECL's phar code.
>

I've backported the fixes to pecl/phar. Thanks.

-- 
Regards,
Felipe Pena

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.