Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 12 Mar 2015 10:18:47 -0400 (EDT)
From: Siddharth Sharma <>
Subject: Re: Re: CVE request: spencer regexp


That seems to be possible via php, using php_ereg(), php_ereg_replace() , php_ereg_split() 
which might call regcomp() in backend.

Siddharth Sharma / Red Hat Product Security 

----- Original Message -----
Sent: Wednesday, March 11, 2015 10:41:59 PM
Subject: [oss-security] Re: CVE request: spencer regexp

Hash: SHA1

> says "I have to
admit we're having a hard time trying to think of a service that
exposes regcomp(3) over the internet." says "in many
cases the code is only used when building for Android or Windows" and
indirectly refers to multiple bugs such as:

For example:

  Package: cups

  The regex copy is only used when building on Windows. I double-checked
  by removing the entire vcnet/regex directory and rebuilding cups.

This is potentially ambiguous. We thought that "when building on
Windows" would imply something like "if a user is following the steps
in the CUPS INSTALL.txt file on a Windows machine, then that user is
able to provide malicious input to the regcomp function during one of
those steps." It now appears that what was meant was "The problematic
regcomp function is present in a Windows build of CUPS. Any
exploitation could occur only after the build has finished."

In general, when one oss-security post suggests that an issue may not
be realistically exploitable with untrusted input (e.g., "having a
hard time trying to think of a service" above), and no other
oss-security post suggests that the issue is realistically
exploitable, then there might not be a CVE assignment.

Here, we'll propose an exploitation scenario for comment. We think
that this is (at least marginally) realistic, although it might not
be. Unless there's an objection stating that no realistic exploitation
scenario can exist, we'll assign a CVE ID for the original regcomp bug
this week.


  Someone develops a new email filtering language as an alternative
  to Sieve (RFC 5228). Like Sieve, the language's scripts are
  intended to run on a mail server that does not permit arbitrary
  code execution by ordinary mailbox owners. In the new language,
  the match type of ":matches" is implemented with regcomp.
  There is no limit on script size, and thus the 682 Mb requirement
  from the regcomp bug report isn't a concern. It is plausible that
  an ordinary mailbox owner can create a script that triggers the
  bug and achieves remote code execution on the mail server.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.