Edit report at https://bugs.php.net/bug.php?id=47828&edit=1
ID: 47828
Comment by: php at pzystorm dot de
Reported by: reinke at securityspace dot com
Summary: Seg Fault in openssl_x509_parse
Status: Closed
Type: Bug
Package: OpenSSL related
Operating System: Linux (Debian Lenny)
PHP Version: 5.2.9
Assigned To: scottmac
Block user comment: N
Private report: N
New Comment:
I have this segfault error with this cert:
-----BEGIN CERTIFICATE-----
MIIFJjCCBA6gAwIBAgIHKAOS9pUMTDANBgkqhkiG9w0BAQsFADCBtDELMAkGA1UE
BhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAY
BgNVBAoTEUdvRGFkZHkuY29tLCBJbmMuMS0wKwYDVQQLEyRodHRwOi8vY2VydHMu
Z29kYWRkeS5jb20vcmVwb3NpdG9yeS8xMzAxBgNVBAMTKkdvIERhZGR5IFNlY3Vy
ZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjAeFw0xNDEyMDYwMDEzMThaFw0x
NzEyMTUyMDExMjFaMD0xITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRl
ZDEYMBYGA1UEAwwPKi53b3JkcHJlc3Mub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAt+6frTJfO3cL1/bxm02IFZB4koTgTnfwmqPPJRHZvwAUEiC9
lqZv2lPnxQtAjKZEei9TTFSQRLIih50CAZNT8ce6GruNTY95vLLJAHF4Csi6m5OZ
fx6Yk/lmzsRlAwdT85GLnl4jcgH0uU/bZTwz1MlCaxdDcVu2zAK1PnLj+wcELwGP
ifqtLnYVShlLPza295UvTOaVmp+VYcWvSwLtn+OiqXd405PWo3M13Yoh5/PyHajH
dBdDWhA4hrPvHvjbfKx5zcp/buoY3dRLHoOH+nE0k3QXraEDTY2MzOdMDKQriqhR
r82GswENojt35M4z7MA9KR1FwoSUdGbaiqGw9QIDAQABo4IBsTCCAa0wDAYDVR0T
AQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDgYDVR0PAQH/
BAQDAgWgMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwuZ29kYWRkeS5jb20v
Z2RpZzJzMS04Ny5jcmwwUwYDVR0gBEwwSjBIBgtghkgBhv1tAQcXATA5MDcGCCsG
AQUFBwIBFitodHRwOi8vY2VydGlmaWNhdGVzLmdvZGFkZHkuY29tL3JlcG9zaXRv
cnkvMHYGCCsGAQUFBwEBBGowaDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZ29k
YWRkeS5jb20vMEAGCCsGAQUFBzAChjRodHRwOi8vY2VydGlmaWNhdGVzLmdvZGFk
ZHkuY29tL3JlcG9zaXRvcnkvZ2RpZzIuY3J0MB8GA1UdIwQYMBaAFEDCvSeOzDSD
MKIz1/tss/C0LIDOMCkGA1UdEQQiMCCCDyoud29yZHByZXNzLm9yZ4INd29yZHBy
ZXNzLm9yZzAdBgNVHQ4EFgQUTqA0/Tj3XxNMtsLjOsC9Kp8eLVgwDQYJKoZIhvcN
AQELBQADggEBACCua5vWQNfTc5aWJu80e6svEmQ7nTv8BeR1jWCUEgPz3EZqRE/P
64lZD+hjU+6sf3KLTqiwvdMef43kcpAHp7w4rUQm0NbW4RP5BcRIjdihfjjLLEfu
sT7KzKWPeb6msjEunKlzEZa9uvmFUz3zCWu9Z0p7QCaudGz9ldJxoOiPxXK2R5qd
T5AJvhH7+WpuxF6RXbjzpkcXOWB2gcidTI/Bw59a90X/ZoJJyaTT2iXP8cYECtwn
Mxo4/P3vJYtE3QFnev7zP+o5CT0gzCmjb9sLOvZE5fRxm+PEefyaFHMebNCElGtC
ZpM3tyeiqyIQK61TeTTSusxnCFjXIDa0tjQ=
-----END CERTIFICATE-----
Just save it in a file (f.ex. test.pem) and call this php code:
<?php
$ssl = openssl_x509_parse(file_get_contents('test.pem'));
print_r($ssl);
?>
Error in the Apache log file is:
[core:notice] [pid 16919] AH00052: child pid 16925 exit signal Segmentation fault (11)
No further debug information availavle, although "LogLevel debug"
Previous Comments:
------------------------------------------------------------------------
[2009-03-30 18:08:46] pajoye@php.net
For the record here, if you use ubuntu you can follow this issue here:
https://bugs.launchpad.net/bugs/351730
I also updated the test case using the one from Kees Cook as it covers more architectures (incl. the
intel ones I have here, and that's nice :).
------------------------------------------------------------------------
[2009-03-30 14:55:40] pajoye@php.net
Note that even people from Ubuntu security were not able to reproduce it (I asked them to take a
look at the report). So excuse me but there were doubts about this bug, like it or not. And
that's why I asked you to test with our src, you did, thanks.
Also I did not ask you to do not use the distribution version of php but to use our sources to see
if the bug can be reproduced. It is common practice to ask that, not only in php.
------------------------------------------------------------------------
[2009-03-30 14:43:12] reinke at securityspace dot com
>>No, our official distributions channel is http://www.php.net/downloads
and http://windows.php.net, nothing else.
Pierre - that's wishful thinking and a pile of crock.
Argue over the semantics of "official" however you
wish. The reality, however, is that about 28% of
all web sites with PHP are known to be using a
Distro version of PHP. And of the remaining 72%,
we can't even say they are using a version from
your web site, only that we don't know if they are
using your version, or one from a distro.
Don't get me wrong - your (PHP's) fix time on this was
absolutely amazing, and to repeat, we have no issue with
helping out on a problem. But telling folks not to use a
distro version of PHP is just not in line with reality.
And for the record - every 5.2.x install we've
touched on a Linux box was vulnerable. If you
couldn't reproduce on Ubuntu or Debian using
the concise 3 line script provided after several
hours of our digging to make it easy on you, perhaps
you need to have a broader range of hardware to
check on. Every x86 based install WE checked on
5.2.x was vulnerable and reproduced the problem.
INCLUDING your latest snapshot.
Grumble - you ought to take this thread and mark it as a
"how to take a customer that was willing to help find
a bug that crashes your application and really piss
him off."
Scott - thanks for the quick fix. Above and beyond.
Thomas
------------------------------------------------------------------------
[2009-03-30 09:59:49] pajoye@php.net
Firt, I do not care if it took 0.5 second or 3 hours.
Secondly, the bug is less than a day old, we did run test and it did not crash on all platforms I
can test (windows, ubuntu x64/x86 and debian). So not it was not obvious that there was a real bug
in the current code.
And finally, you can't know if a) there is already a patch or a fix and b) what's the
status, simply because you did not bother to ask.
There is no problem to take over any bug as long as you simply ask before. It will save us time and
pains (as in this kind of discussions, which happen only with you).
Thanks for your understanding and your work.
------------------------------------------------------------------------
[2009-03-30 09:24:43] scottmac@php.net
Pierre using the test given by the reporter I could reproduce this, took less than a minute to find
the issue.
Assigning yourself a bug that you'll look at next week isn't all that useful, especially
if someone with more time comes along in that next week. Perhaps we need to add multiple assignment
to bugs?
FYI OpenSSL verions
OpenSSL 0.9.7l 28 Sep 2006 (OS X default)
OpenSSL 0.9.8j 07 Jan 2009
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=47828
--
Edit this bug report at https://bugs.php.net/bug.php?id=47828&edit=1