php5: CVE-2015-4604 CVE-2015-4605

Debian Bug report logs - #783099
php5: CVE-2015-4604 CVE-2015-4605

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: submit@bugs.debian.org

Subject: php5: Fileinfo on specific file causes spurious OOM and/or segfault

Date: Wed, 22 Apr 2015 11:35:45 +0300

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Source: php5
Version: 5.6.7+dfsg-1
Severity: grave
Tags: security, upstream, fixed-upstream

Hi,

the following vulnerability was published for PHP5,

"""
When calling finfo::file() or finfo::buffer() with a crafted string, PHP will
crash by either segfaulting or trying to allocate an large amount of memory
(4GiB).

This was found in the wild when a user uploaded a file (running finfo on
arbitrary files uploaded by users is one of its main use cases.). I've since
anonymised the file, and made it more minimal. At this stage, very small changes
to the string make it produce different behaviour - removing the remaining 'a',
's', or 'y' characters, for instance, will allow finfo to process it fine.
"""

For further information see:
  https://bugs.php.net/bug.php?id=68819
  https://git.php.net/?p=php-src.git;a=commitdiff;h=f938112c495b0d26572435c0be73ac0bfe642ecd

- -- 
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVN11hAAoJECet96ROqnV0NFwP/1WyM6/jYhMkuyyjIDuGJLR6
5agci0HcM64R5It7Dvoy7HPtP431Qg5XvtJBn2P5YRq9Kgh4g0T7NeA4jbQIQEQs
lj/zO4zfBSnhCvkCbsqhLDYDASx1M2esXgfXy4EDejBPvVMSPtSr3GjVt9Ptufty
/GgA3FRf+XDDNNDebGsDVvkKH5pAvK7QN8R8UsmG8uiEYP9+vdlwdAK5pykrWsGa
yZEm7x/OXjETTnjIoz+0p89ExFBBuNyryhMQGVfiJxivTMHaHMBuZ/2BlBhIM0S2
VTf42JtlLTmG6NZW71OplY2kN1f+p+ADXy/OUtwbV700tuk58wIwt+r5Ymqa9wmA
crO2xyNm2CgA0K6Vew0vEYBWVc7fFQQuGhQX6lKOwng3OXaM3Xo9BzEvrOGVrTgz
sw7ilWb4kfUTjtZoAYVOqL0YTafMi3CzjmH3MzeFMyxMRtYlqgc7S+KrqJXWMX2A
TlqA2WhAOMIHNG8xxuXdwlzzVRoPakY0Jkgx5XdUlU9QdNmeIljcxdPAIXHAeEAj
IPSBQFUjAZABB7GWKgZcyJv6p2Z9nc5GkQ9RYm297QtGbPVYGUfmBZsJOloJfXIF
V4dRZWkVoonbaC5WtjaGPyOIHnl35AZ7Hl4MkQ5JMzScbN3u1BooY1+NXNBsHTPL
JLN2O58YQiTodP1AZWfx
=y0h8
-----END PGP SIGNATURE-----

Message #14 received at 783099@bugs.debian.org (full text, mbox, reply):

From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

To: Henri Salo <henri@nerv.fi>, 783099@bugs.debian.org

Subject: Re: Bug#783099: php5: Fileinfo on specific file causes spurious OOM and/or segfault

Date: Thu, 23 Apr 2015 09:23:47 +0200

[Message part 1 (text/plain, inline)]

tags 783099 unreproducible
thanks

Henri Salo wrote...

> When calling finfo::file() or finfo::buffer() with a crafted string, PHP will
> crash by either segfaulting or trying to allocate an large amount of memory
> (4GiB).
(...)
>   https://git.php.net/?p=php-src.git;a=commitdiff;h=f938112c495b0d26572435c0be73ac0bfe642ecd

What kind of alert is this?

* "Saw this, just forwarding, your job"
* "Tried a few things, file seems to be robust, thought you might be
  interested anyway"
* "It's vulnerable, reproducer attached/available upon request"

So assuming the first:

Using to the reproducer generators I was indeed able to segfault
php5 in wheezy (both) and jessie (001 only) every time - not
squeeze-lts though. However, running the file program against a dump
of any generated file worked flawlessly. In fact, I couldn't trigger
a segfault in any upstream release I've tested between 5.04 and 5.22.

According to the patch php5 applied this seems to be a duplicate of
CVE-2014-3538 which is fixed in all Debian versions of the file
package. However, testing upstream commits around the fix
(FILE5_18-69-g4a284c8g) still shows no abnormal behaviour. Also,
php5 did fix this issue last year, too. However the softmagic.c file
differs between file and php5 anyway so it might be a pure php5
problem.

If you have different information, please submit in due course.

    Christoph

[signature.asc (application/pgp-signature, inline)]

Message #23 received at 783099@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

Cc: 783099@bugs.debian.org

Subject: Re: Bug#783099: php5: Fileinfo on specific file causes spurious OOM and/or segfault

Date: Thu, 23 Apr 2015 17:06:10 +0300

I reported this issue to Debian BTS to notify package maintainers and in the
long run trying to get security issues fixed. Maintainers are not always
following security issues in upstream and so on (not saying this about PHP). I
verified that the segfault condition occurred and did not do more detailed
analysis of the issue. If there is no security issue in PHP with the poc we can
close this bug.

-- 
Henri Salo

Message #28 received at 783099@bugs.debian.org (full text, mbox, reply):

From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

To: Henri Salo <henri@nerv.fi>

Cc: 783099@bugs.debian.org

Subject: Re: Bug#783099: php5: Fileinfo on specific file causes spurious OOM and/or segfault

Date: Fri, 24 Apr 2015 10:35:33 +0200

[Message part 1 (text/plain, inline)]

Henri Salo wrote...

> I reported this issue to Debian BTS to notify package maintainers and in the
> long run trying to get security issues fixed. Maintainers are not always
> following security issues in upstream and so on (not saying this about PHP). I

This is appreciated but a short report about what has been done so far
helps the maintainer to organize the next steps. Even if it's just an
"I didn't take a closer look so it might be a non-issue".

> verified that the segfault condition occurred and did not do more detailed
> analysis of the issue. If there is no security issue in PHP with the poc we can
> close this bug.

The crucial question is: Did you verify this in php5 or in file?

Repeating myself another time, just in other words:

* php5 certainly is affected.
* file: I cannot see be that. Neither from the source code nor from
  the reproducers that segfault php.

However, I can be convinced otherwise. Just provide a reproducer.

    Christoph

[signature.asc (application/pgp-signature, inline)]

Message #41 received at 783099-done@bugs.debian.org (full text, mbox, reply):

From: Lior Kaplan <kaplanlior@gmail.com>

To: 783099-done@bugs.debian.org

Subject: Fixed

Date: Mon, 17 Aug 2015 13:41:56 +0200

[Message part 1 (text/plain, inline)]

Version: 5.6.9+dfsg-1

This issue has been fixed for unstable, testing, stable and oldstable.
Closing the bug.

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.