Bug #69418 [NEW]: CVE-2006-7243 fix regressions in 5.4+

From: thoger at redhat dot com Operating system: PHP version: 5.5.23 Package: *Directory/Filesystem functions Bug Type: Bug Bug description:CVE-2006-7243 fix regressions in 5.4+ Description: ------------ After seeing CVE-2015-2348 and CVE-2014-5120, which are both 5.4+ regressions of parts of the CVE-2006-7243 fix, I ran some quick testing to catch more similar regressions (only for ext/standard). Here are few more issues I noticed. Tested on 5.5.23, quick look at git 5.6 branch suggests 5.6 should be affected similarly. * set_include_path - not sure if this can use 5.4-like fix using zend_parse_parameters() 'p' format, or needs 5.3-like fix with strlen(new_value) != new_value_len $ php -r 'var_dump(set_include_path("/path/to/php\0extra")); echo get_include_path()."\n";' string(32) ".:/usr/share/pear:/usr/share/php" /path/to/php * tempnam - dir is checked to be path and not contain \0, prefix is not $ php -r 'var_dump(tempnam("/tmp\0extra", "prefix"));' PHP Warning: tempnam() expects parameter 1 to be a valid path, string given in Command line code on line 1 NULL $ php -r 'var_dump(tempnam("/tmp/", "prefix\0extra"));' string(17) "/tmp/prefixh3EaGL" * rmdir $ php -r 'var_dump(rmdir("/tmp/foo\0extra"));' PHP Warning: rmdir(/tmp/foo): No such file or directory in Command line code on line 1 bool(false) * readlink $ php -r 'var_dump(readlink("/bin/sh\0extra"));' string(4) "bash" For reference, here are links for CVE-2006-7243 fixes in 5.3 and 5.4: 5.3 http://git.php.net/?p=php-src.git;a=commitdiff;h=ce96fd6 5.4 http://git.php.net/?p=php-src.git;a=commitdiff;h=32b5f8a -- Edit bug report at https://bugs.php.net/bug.php?id=69418&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69418&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69418&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69418&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69418&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69418&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69418&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69418&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69418&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69418&r=support Expected behavior: https://bugs.php.net/fix.php?id=69418&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69418&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69418&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69418&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69418&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69418&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69418&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69418&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69418&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69418&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69418&r=mysqlcfg