First Last Prev Next    This bug is not in your last search results.
Bug 982011 - (CVE-2016-5094) VUL-0: CVE-2016-5094: php5, php53: don't create strings with lengths outside int range
(CVE-2016-5094)
VUL-0: CVE-2016-5094: php5, php53: don't create strings with lengths outside ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
CVSSv2:SUSE:CVE-2016-5094:4.3:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2016-05-27 12:42 UTC by Alexander Bergmann
Modified: 2016-08-01 09:57 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
patch for 11sp3 (1.11 KB, patch)
2016-06-01 08:22 UTC, Petr Gajdos 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2016-05-27 12:42:08 UTC 
http://seclists.org/oss-sec/2016/q2/412

https://git.php.net/?p=php-src.git;a=commit;h=0da8b8b801f9276359262f1ef8274c7812d3dfda

 Fix bug #72135 - don't create strings with lengths outside int range

https://bugs.php.net/bug.php?id=72135

Use CVE-2016-5094 for the original report that had the "[2016-05-16 06:28 UTC] Fix in security repo as 0da8b8b801f9276359262f1ef8274c7812d3dfda" response.
Comment 1 Swamp Workflow Management 2016-05-27 22:00:46 UTC 
bugbot adjusting priority
Comment 2 Petr Gajdos 2016-06-01 08:21:18 UTC 
Tested with 13.2, 12, 11sp3.

Installed packages: php5

$ cat poc1.php
<?php

	ini_set('memory_limit', -1);
	$str = htmlspecialchars(str_repeat('&', 0xffffffff/5));
	var_dump(strlen($str));
	
?>

$ cat poc2.php
<?php

	ini_set('memory_limit', -1);
	$str = htmlspecialchars(str_repeat('&', 0xffffffff/5));
	md5($str);
	
?>
$ cat poc3.php
<?php

ini_set('memory_limit', -1);
$str = htmlspecialchars(str_repeat('&', 0xffffffff/5));
"$str";

?>
$ cat poc4.php
<?php

ini_set('memory_limit', -1);
$var = str_repeat('&', 0xffffffff/5);
$var = filter_var($var, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
echo "$var";

?>
:/982011 # 


BEFORE

13.2
$ php poc1.php
int(-1)

$ php poc2.php
Segmentation fault (core dumped)
$ php poc3.php
Segmentation fault (core dumped)
$ php poc4.php
Segmentation fault (core dumped)
$

12
$ php poc1.php
int(-1)

$ php poc2.php
Segmentation fault (core dumped)
$ php poc3.php
Segmentation fault (core dumped)
$ php poc4.php
PHP Warning:  filter_var(): charset `ANSI_X3.4-1968' not supported, assuming utf-8 in /982011/poc4.php on line 5
Segmentation fault (core dumped)
$

11sp3

$ php poc1.php
PHP Fatal error:  Out of memory (allocated 3007578112) (tried to allocate -2147483546 bytes) in /982011/poc1.php on line 4
$ php poc2.php
PHP Fatal error:  Out of memory (allocated 3007578112) (tried to allocate -2147483546 bytes) in /982011/poc2.php on line 4
$ php poc3.php
PHP Fatal error:  Out of memory (allocated 3007578112) (tried to allocate -2147483546 bytes) in /982011/poc3.php on line 4
$ php poc4.php
Segmentation fault (core dumped)

Only fourth reproducer works. Segfaults happen sooner:

#0  0x00007ffff66555d8 in memcpy () from /lib64/libc.so.6
No symbol table info available.
#1  0x000000000057e1c3 in add_string_to_string (result=0x7ffff7e961e0, op1=0x7ffff7e961e0, op2=0xb426f8) at /usr/include/bits/string3.h:52
        length = -1
#2  0x00000000005cfb99 in ZEND_ADD_VAR_SPEC_UNUSED_CV_HANDLER (execute_data=0x7ffff7e96050)
    at /usr/src/debug/php-5.3.17/Zend/zend_vm_execute.h:21255
        opline = <optimized out>
        var = 0xb426f8
        var_copy = {value = {lval = 11806456, dval = 5.8331643087362603e-317, str = {val = 0xb426f8 "0", len = 6197199}, ht = 0xb426f8, 
            obj = {handle = 11806456, handlers = 0x5e8fcf <ZEND_DO_FCALL_SPEC_CONST_HANDLER+191>}}, refcount__gc = 11811768, 
          type = 0 '\000', is_ref__gc = 0 '\000'}
        use_copy = 0


Note the length = -1 in add_string_to_string().

AFTER

13.2

$ php poc1.php
PHP Fatal error:  Escaped string is too long in /982011/poc1.php on line 4
$ php poc2.php
PHP Fatal error:  Escaped string is too long in /982011/poc2.php on line 4
$ php poc3.php
PHP Fatal error:  Escaped string is too long in /982011/poc3.php on line 4
$ php poc4.php
PHP Fatal error:  Escaped string is too long in /982011/poc4.php on line 5
$

12

$ php poc1.php
PHP Fatal error:  Escaped string is too long in /982011/poc1.php on line 4
$ php poc3.php
PHP Fatal error:  Escaped string is too long in /982011/poc3.php on line 4
$ php poc2.php
PHP Fatal error:  Escaped string is too long in /982011/poc2.php on line 4
$ php poc4.php
PHP Warning:  filter_var(): charset `ANSI_X3.4-1968' not supported, assuming utf-8 in /982011/poc4.php on line 5
PHP Fatal error:  Escaped string is too long in /982011/poc4.php on line 5
$

11sp3

$ php poc1.php
PHP Fatal error:  Out of memory (allocated 3007578112) (tried to allocate -2147483546 bytes) in /982011/poc1.php on line 4
$ php poc2.php
PHP Fatal error:  Out of memory (allocated 3007578112) (tried to allocate -2147483546 bytes) in /982011/poc2.php on line 4
$ php poc3.php
PHP Fatal error:  Out of memory (allocated 3007578112) (tried to allocate -2147483546 bytes) in /982011/poc3.php on line 4
$ php poc4.php 
PHP Fatal error:  string operator too long in /982011/poc4.php on line 6
$
Comment 3 Petr Gajdos 2016-06-01 08:22:15 UTC 
Created attachment 679023 [details]
patch for 11sp3
Comment 4 Petr Gajdos 2016-06-01 11:20:55 UTC 
Packages submitted.
Comment 5 Bernhard Wiedemann 2016-06-01 12:01:29 UTC 
This is an autogenerated message for OBS integration:
This bug (982011) was mentioned in
https://build.opensuse.org/request/show/399462 13.2 / php5
Comment 7 Swamp Workflow Management 2016-06-11 12:17:26 UTC 
openSUSE-SU-2016:1553-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 976775,980366,980373,980375,981049,981050,981061,982009,982010,982011,982012,982013,982162
CVE References: CVE-2013-7456,CVE-2015-4116,CVE-2015-8873,CVE-2015-8874,CVE-2015-8876,CVE-2015-8877,CVE-2015-8879,CVE-2016-3074,CVE-2016-5093,CVE-2016-5094,CVE-2016-5095,CVE-2016-5096,CVE-2016-5114
Sources used:
openSUSE 13.2 (src):    php5-5.6.1-66.1
Comment 8 Swamp Workflow Management 2016-06-14 18:12:09 UTC 
SUSE-SU-2016:1581-1: An update that fixes 31 vulnerabilities is now available.

Category: security (important)
Bug References: 949961,968284,969821,971611,971612,971912,973351,973792,976996,976997,977003,977005,977991,977994,978827,978828,978829,978830,980366,980373,980375,981050,982010,982011,982012,982013,982162
CVE References: CVE-2014-9767,CVE-2015-4116,CVE-2015-7803,CVE-2015-8835,CVE-2015-8838,CVE-2015-8866,CVE-2015-8867,CVE-2015-8873,CVE-2015-8874,CVE-2015-8879,CVE-2016-2554,CVE-2016-3141,CVE-2016-3142,CVE-2016-3185,CVE-2016-4070,CVE-2016-4073,CVE-2016-4342,CVE-2016-4346,CVE-2016-4537,CVE-2016-4538,CVE-2016-4539,CVE-2016-4540,CVE-2016-4541,CVE-2016-4542,CVE-2016-4543,CVE-2016-4544,CVE-2016-5093,CVE-2016-5094,CVE-2016-5095,CVE-2016-5096,CVE-2016-5114
Sources used:
SUSE OpenStack Cloud 5 (src):    php53-5.3.17-71.1
SUSE Manager Proxy 2.1 (src):    php53-5.3.17-71.1
SUSE Manager 2.1 (src):    php53-5.3.17-71.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    php53-5.3.17-71.1
SUSE Linux Enterprise Server 11-SP4 (src):    php53-5.3.17-71.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    php53-5.3.17-71.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    php53-5.3.17-71.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    php53-5.3.17-71.1
Comment 9 Swamp Workflow Management 2016-06-20 14:09:47 UTC 
SUSE-SU-2016:1633-1: An update that fixes 8 vulnerabilities is now available.

Category: security (moderate)
Bug References: 981049,981050,981061,982009,982010,982011,982012,982013
CVE References: CVE-2013-7456,CVE-2015-8876,CVE-2015-8877,CVE-2015-8879,CVE-2016-5093,CVE-2016-5094,CVE-2016-5095,CVE-2016-5096
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    imap-2007e_suse-19.1
SUSE Linux Enterprise Workstation Extension 12 (src):    imap-2007e_suse-19.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    imap-2007e_suse-19.1, php5-5.5.14-64.5
SUSE Linux Enterprise Software Development Kit 12 (src):    imap-2007e_suse-19.1, php5-5.5.14-64.5
SUSE Linux Enterprise Module for Web Scripting 12 (src):    imap-2007e_suse-19.1, php5-5.5.14-64.5
SUSE Linux Enterprise Desktop 12-SP1 (src):    imap-2007e_suse-19.1
SUSE Linux Enterprise Desktop 12 (src):    imap-2007e_suse-19.1
Comment 10 Swamp Workflow Management 2016-06-21 11:20:50 UTC 
SUSE-SU-2016:1638-1: An update that fixes 85 vulnerabilities is now available.

Category: security (important)
Bug References: 884986,884987,884989,884990,884991,884992,885961,886059,886060,893849,893853,902357,902360,902368,910659,914690,917150,918768,919080,921950,922451,922452,923945,924972,925109,928506,928511,931421,931769,931772,931776,933227,935074,935224,935226,935227,935229,935232,935234,935274,935275,938719,938721,942291,942296,945412,945428,949961,968284,969821,971611,971612,971912,973351,973792,976996,976997,977003,977005,977991,977994,978827,978828,978829,978830,980366,980373,980375,981050,982010,982011,982012,982013,982162
CVE References: CVE-2004-1019,CVE-2006-7243,CVE-2014-0207,CVE-2014-3478,CVE-2014-3479,CVE-2014-3480,CVE-2014-3487,CVE-2014-3515,CVE-2014-3597,CVE-2014-3668,CVE-2014-3669,CVE-2014-3670,CVE-2014-4049,CVE-2014-4670,CVE-2014-4698,CVE-2014-4721,CVE-2014-5459,CVE-2014-8142,CVE-2014-9652,CVE-2014-9705,CVE-2014-9709,CVE-2014-9767,CVE-2015-0231,CVE-2015-0232,CVE-2015-0273,CVE-2015-1352,CVE-2015-2301,CVE-2015-2305,CVE-2015-2783,CVE-2015-2787,CVE-2015-3152,CVE-2015-3329,CVE-2015-3411,CVE-2015-3412,CVE-2015-4021,CVE-2015-4022,CVE-2015-4024,CVE-2015-4026,CVE-2015-4116,CVE-2015-4148,CVE-2015-4598,CVE-2015-4599,CVE-2015-4600,CVE-2015-4601,CVE-2015-4602,CVE-2015-4603,CVE-2015-4643,CVE-2015-4644,CVE-2015-5161,CVE-2015-5589,CVE-2015-5590,CVE-2015-6831,CVE-2015-6833,CVE-2015-6836,CVE-2015-6837,CVE-2015-6838,CVE-2015-7803,CVE-2015-8835,CVE-2015-8838,CVE-2015-8866,CVE-2015-8867,CVE-2015-8873,CVE-2015-8874,CVE-2015-8879,CVE-2016-2554,CVE-2016-3141,CVE-2016-3142,CVE-2016-3185,CVE-2016-4070,CVE-2016-4073,CVE-2016-4342,CVE-2016-4346,CVE-2016-4537,CVE-2016-4538,CVE-2016-4539,CVE-2016-4540,CVE-2016-4541,CVE-2016-4542,CVE-2016-4543,CVE-2016-4544,CVE-2016-5093,CVE-2016-5094,CVE-2016-5095,CVE-2016-5096,CVE-2016-5114
Sources used:
SUSE Linux Enterprise Server 11-SP2-LTSS (src):    php53-5.3.17-47.1
Comment 11 Swamp Workflow Management 2016-06-27 13:10:43 UTC 
openSUSE-SU-2016:1688-1: An update that fixes 8 vulnerabilities is now available.

Category: security (moderate)
Bug References: 981049,981050,981061,982009,982010,982011,982012,982013
CVE References: CVE-2013-7456,CVE-2015-8876,CVE-2015-8877,CVE-2015-8879,CVE-2016-5093,CVE-2016-5094,CVE-2016-5095,CVE-2016-5096
Sources used:
openSUSE Leap 42.1 (src):    imap-2007e_suse-22.1, php5-5.5.14-53.1
Comment 12 Marcus Meissner 2016-08-01 09:57:18 UTC 
all released
First Last Prev Next    This bug is not in your last search results.