Bug 662932 - VUL-1: php5: possible flaw in widely used strtod.c implementation
VUL-1: php5: possible flaw in widely used strtod.c implementation
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: General
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
. maint:released:11.2:39275 maint:rel...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-01-07 08:35 UTC by Thomas Biege
Modified: 2011-04-01 20:31 UTC (History)
1 user (show)

See Also:
Found By: Development
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Biege 2011-01-07 08:35:20 UTC
Hi.
There is a security bug in package 'php5'.

This information is from 'oss-security'.

This bug is public.

There is no coordinated release date (CRD) set.

More information can be found here:
	http://www.google.com/codesearch?as_q=strtod+for+IEEE-,+VAX-,+and+IBM-

CVE number: CVE-2010-4645
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4645
CVSS v2 Base Score: 2.6 (low) (AV:N/AC:H/Au:N/C:N/I:N/A:P)


Original posting:



CVE-2010-4645

----------  Weitergeleitete Nachricht  ----------

Betreff: [oss-security] possible flaw in widely used strtod.c implementation
Datum: Mittwoch 05 Januar 2011
Von: Pierre Joye <pierre.php@gmail.com>
An: oss-security@lists.openwall.com

hi,

Referring to: http://bugs.php.net/53632

This bug affects PHP and can be remotely triggered if someone actually
process an input as double (p.php?id=... and then $d
= $id +1 for example). However this issue could also affect any
software relying on the "strtod for IEEE-, VAX-, and IBM-arithmetic
machines." implementation (quite a lot actually do, according to
codesearch&co). See a non exhaustive list here:

http://www.google.com/codesearch?as_q=strtod+for+IEEE-,+VAX-,+and+IBM-
arithmetic+machines.&btnG=Search+Code&hl=en&as_package=&as_lang=&as_filename=&as_class=&as_function=&as_license=&as_case=

Whether the bug exists in the respective builds of each of these
softwares may depend on how they are built (options, arch, etc.).

A fix is already in php's svn:
http://svn.php.net/viewvc?view=revision&revision=307095

A good explanation about this issue is in the gcc bug tracker (thanks
Rasmus for the pointer):

It is a design flaw in the x87 fpu registers, so keeping the float out
of those registers circumvents the problem.  It is
one of the suggested ways of fixing this that is mentioned in the famous
gcc bug 323 report:

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=323

See Comment 87:

 bruno 2006-12-21 15:08:57 UTC
 The option -ffloat-store, recommended by Richard Henderson, has
 the effect of decreasing the performance of floating-point
 operations for the entire compilation unit. If you want a minimal
 fix that does not affect other functions in the same compilation
 unit, you can use 'volatile double' instead of 'double'. It's
 like a one-shot -ffloat-store. Example:

 #include <stdio.h>

 void test(double x, double y) {
   const volatile double y2 = x + 1.0;
   if (y != y2) printf("error\n");
 }

 void main() {
   const double x = .012;
   const double y = x + 1.0;

   test(x, y);
 }

On windows it is slightly more complicated as it seems to do some more
under the wood work. I was able to reproduce the problem on certain
CPUs (i7) and not on other  (xeon) using the exact same binaries. I
still have to verify what is done exactly.

About getting a CVE #, I'm not sure it should be categorized only for
php or more generally about this strtod.c (newest version has the same
problem btw). Ideas? Comments?

Cheers,
--
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org

-------------------------------------------------------------
Comment 1 Thomas Biege 2011-01-07 08:45:20 UTC
CVE-2010-4645
Comment 2 Thomas Biege 2011-01-07 08:45:32 UTC
CVE-2010-4645: CVSS v2 Base Score: 2.6 (low) (AV:N/AC:H/Au:N/C:N/I:N/A:P): unknown (unknown)
Comment 3 Thomas Biege 2011-01-07 08:45:56 UTC
will be put on planned update lst.
Comment 4 Thomas Biege 2011-01-07 09:24:53 UTC
https://bugzilla.redhat.com/show_bug.cgi?id=667806:
Vincent Danen 2011-01-06 15:30:39 EST

A flaw in how PHP handled the numeric value 2.2250738585072011e-308 was
reported [1].  If a script were to assign this value to a variable, it could
cause PHP to hang (infinite loop).  This issue has been fixed in upstream PHP
[2] 5.2.17 and 5.3.5.

[1] http://bugs.php.net/53632
[2] http://svn.php.net/viewvc?view=revision&revision=307095
Comment 5 Michal Vyskocil 2011-01-07 10:27:44 UTC
Petr, please be so kind and take this another VUL-1 php issue
Comment 6 Sebastian Krahmer 2011-01-11 07:54:48 UTC
Via OSS-Sec:


Since this problem stems from a single codebase, strtod.c, so it gets a
single CVE identifier (already assigned CVE-2010-4645).  The CVE
description will "blame" strtod.c and mention PHP, and any other
high-profile software that is discovered to use the same vulnerable,
shared code.

- Steve
Comment 7 Petr Gajdos 2011-01-17 08:09:51 UTC
Please take a look at following submit requests:
11.3 #58448, 11.2 #58447, 11sp1 #10102, 10sp3 #10103
Comment 8 Swamp Workflow Management 2011-04-01 09:03:06 UTC
Update released for: apache2-mod_php5, apache2-mod_php5-debuginfo, php5, php5-bcmath, php5-bcmath-debuginfo, php5-bz2, php5-bz2-debuginfo, php5-calendar, php5-calendar-debuginfo, php5-ctype, php5-ctype-debuginfo, php5-curl, php5-curl-debuginfo, php5-dba, php5-dba-debuginfo, php5-debuginfo, php5-debugsource, php5-devel, php5-dom, php5-dom-debuginfo, php5-enchant, php5-enchant-debuginfo, php5-exif, php5-exif-debuginfo, php5-fastcgi, php5-fastcgi-debuginfo, php5-fileinfo, php5-fileinfo-debuginfo, php5-ftp, php5-ftp-debuginfo, php5-gd, php5-gd-debuginfo, php5-gettext, php5-gettext-debuginfo, php5-gmp, php5-gmp-debuginfo, php5-hash, php5-hash-debuginfo, php5-iconv, php5-iconv-debuginfo, php5-imap, php5-imap-debuginfo, php5-intl, php5-intl-debuginfo, php5-json, php5-json-debuginfo, php5-ldap, php5-ldap-debuginfo, php5-mbstring, php5-mbstring-debuginfo, php5-mcrypt, php5-mcrypt-debuginfo, php5-mysql, php5-mysql-debuginfo, php5-odbc, php5-odbc-debuginfo, php5-openssl, php5-openssl-debuginfo, php5-pcntl, php5-pcntl-debuginfo, php5-pdo, php5-pdo-debuginfo, php5-pear, php5-pgsql, php5-pgsql-debuginfo, php5-phar, php5-phar-debuginfo, php5-posix, php5-posix-debuginfo, php5-pspell, php5-pspell-debuginfo, php5-readline, php5-readline-debuginfo, php5-shmop, php5-shmop-debuginfo, php5-snmp, php5-snmp-debuginfo, php5-soap, php5-soap-debuginfo, php5-sockets, php5-sockets-debuginfo, php5-sqlite, php5-sqlite-debuginfo, php5-suhosin, php5-suhosin-debuginfo, php5-sysvmsg, php5-sysvmsg-debuginfo, php5-sysvsem, php5-sysvsem-debuginfo, php5-sysvshm, php5-sysvshm-debuginfo, php5-tidy, php5-tidy-debuginfo, php5-tokenizer, php5-tokenizer-debuginfo, php5-wddx, php5-wddx-debuginfo, php5-xmlreader, php5-xmlreader-debuginfo, php5-xmlrpc, php5-xmlrpc-debuginfo, php5-xmlwriter, php5-xmlwriter-debuginfo, php5-xsl, php5-xsl-debuginfo, php5-zip, php5-zip-debuginfo, php5-zlib, php5-zlib-debuginfo
Products:
openSUSE 11.2 (debug, i586, x86_64)
openSUSE 11.3 (debug, i586, x86_64)
Comment 9 Ludwig Nussel 2011-04-01 09:06:23 UTC
released
Comment 10 Swamp Workflow Management 2011-04-01 15:07:48 UTC
Update released for: apache2-mod_php5, php5, php5-bcmath, php5-bz2, php5-calendar, php5-ctype, php5-curl, php5-dba, php5-dbase, php5-debuginfo, php5-devel, php5-dom, php5-exif, php5-fastcgi, php5-ftp, php5-gd, php5-gettext, php5-gmp, php5-hash, php5-iconv, php5-imap, php5-json, php5-ldap, php5-mbstring, php5-mcrypt, php5-mhash, php5-mysql, php5-ncurses, php5-odbc, php5-openssl, php5-pcntl, php5-pdo, php5-pear, php5-pgsql, php5-posix, php5-pspell, php5-readline, php5-shmop, php5-snmp, php5-soap, php5-sockets, php5-sqlite, php5-suhosin, php5-sysvmsg, php5-sysvsem, php5-sysvshm, php5-tidy, php5-tokenizer, php5-wddx, php5-xmlreader, php5-xmlrpc, php5-xmlwriter, php5-xsl, php5-zip, php5-zlib
Products:
SLE-SDK 10-SP4 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Comment 11 Swamp Workflow Management 2011-04-01 17:35:41 UTC
Update released for: apache2-mod_php5, php5, php5-bcmath, php5-bz2, php5-calendar, php5-ctype, php5-curl, php5-dba, php5-dbase, php5-debuginfo, php5-devel, php5-dom, php5-exif, php5-fastcgi, php5-ftp, php5-gd, php5-gettext, php5-gmp, php5-hash, php5-iconv, php5-imap, php5-json, php5-ldap, php5-mbstring, php5-mcrypt, php5-mhash, php5-mysql, php5-ncurses, php5-odbc, php5-openssl, php5-pcntl, php5-pdo, php5-pear, php5-pgsql, php5-posix, php5-pspell, php5-readline, php5-shmop, php5-snmp, php5-soap, php5-sockets, php5-sqlite, php5-suhosin, php5-sysvmsg, php5-sysvsem, php5-sysvshm, php5-tidy, php5-tokenizer, php5-wddx, php5-xmlreader, php5-xmlrpc, php5-xmlwriter, php5-xsl, php5-zip, php5-zlib
Products:
SLE-DEBUGINFO 10-SP3 (i386, ia64, ppc, s390x, x86_64)
SLE-SAP-APL 10-SP3 (x86_64)
SLE-SDK 10-SP3 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP3 (i386, ia64, ppc, s390x, x86_64)
Comment 12 Swamp Workflow Management 2011-04-01 20:31:26 UTC
Update released for: apache2-mod_php5, php5, php5-bcmath, php5-bz2, php5-calendar, php5-ctype, php5-curl, php5-dba, php5-dbase, php5-debuginfo, php5-debugsource, php5-devel, php5-dom, php5-exif, php5-fastcgi, php5-ftp, php5-gd, php5-gettext, php5-gmp, php5-hash, php5-iconv, php5-imap, php5-json, php5-ldap, php5-mbstring, php5-mcrypt, php5-mysql, php5-ncurses, php5-odbc, php5-openssl, php5-pcntl, php5-pdo, php5-pear, php5-pgsql, php5-posix, php5-pspell, php5-readline, php5-shmop, php5-snmp, php5-soap, php5-sockets, php5-sqlite, php5-suhosin, php5-sysvmsg, php5-sysvsem, php5-sysvshm, php5-tidy, php5-tokenizer, php5-wddx, php5-xmlreader, php5-xmlrpc, php5-xmlwriter, php5-xsl, php5-zip, php5-zlib
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)