bugtraq - Re: SecurityReason : PHP 5.2.6 dba

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 6 Dec 2008 15:47:14 +0300
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: cxib@...urityreason.com
Cc: bugtraq@...urityfocus.com, ilia@....net
Subject: Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file

Maksymilian, Ilia, good day.

Thu, Nov 27, 2008 at 11:54:44PM -0000, cxib@...urityreason.com wrote:
> [ SecurityReason.com PHP 5.2.6 dba_replace() destroying file ]
[...]
> - --- 1. dba_replace() destroying file ---
> 
> Function dba_replace() are not filtring strings key and value. There
> is a possibility the destruction of the file.

This vulnerability exists in 4.x line as well and it is still unpatched.
Had verified it for dba extension from 4.4.9.

According to the revision log,
  http://cvs.php.net/viewvc.cgi/php-src/ext/dba/libinifile/inifile.c?view=log&pathrev=
there is no fix in the official PHP tree for 4.x yet.
-- 
Eygene