#39211 [NEW]: setcookie XSS SECURITY bug

From: josecarlos dot norte at gmail dot com Operating system: all PHP version: 4.4.4 PHP Bug Type: Reproducible crash Bug description: setcookie XSS SECURITY bug Description: ------------ the php function setcookie (ext/standar/head.c) is vulnerable to XSS issue, when parameters passed to setcookie comes from $_REQUEST, an attacker can produce a crash in php, and execute html/javascript code in the context of the vulnerable site. The example provided produce a Warning in php, and in the content of the warning html code is interpreted by the browser. Reproduce code: --------------- <?php setcookie("\n<h1>XSS'ED!</h1>","bug in setcookie function"); ?> Expected result: ---------------- the warning message should be parsed to clean html code, like all warnings in php, for security reasons Actual result: -------------- crash with html code executed. -- Edit bug report at http://bugs.php.net/?id=39211&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=39211&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=39211&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=39211&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=39211&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=39211&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=39211&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=39211&r=needscript Try newer version: http://bugs.php.net/fix.php?id=39211&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=39211&r=support Expected behavior: http://bugs.php.net/fix.php?id=39211&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=39211&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=39211&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=39211&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=39211&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=39211&r=dst IIS Stability: http://bugs.php.net/fix.php?id=39211&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=39211&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=39211&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=39211&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=39211&r=mysqlcfg