Edit report at https://bugs.php.net/bug.php?id=74860&edit=1
ID: 74860
Comment by: spam2 at rhsoft dot net
Reported by: philipp at redfish-solutions dot com
Summary: Uncaught exceptions not being formatted properly
when error_log set to "syslog"
Status: Open
Type: Bug
Package: Output Control
Operating System: linux 4.9.30
PHP Version: 7.1.6
Block user comment: N
Private report: N
New Comment:
GDAMNED:it does not matter where the vulnerability is - make sure that f***g Logfiles don't
contain control chars at all - THAT IS HOW SECURITY WORKS and not by a sloppy "there should not
happen something bad" idiot attitude
Previous Comments:
------------------------------------------------------------------------
[2017-08-04 21:49:19] philipp at redfish-solutions dot com
I'm looking at:
https://www.acunetix.com/vulnerabilities/web/apache-error-log-escape-sequence-injection-vulnerability
Where it says:
"This version of Apache is vulnerable to escape character sequences injection into error
log.This problem may be exploited when a vulnerable terminal emulator is used."
emphasis on the last 5 words. The vulnerability is the broken terminal emulator.
Likewise for:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4487
------------------------------------------------------------------------
[2017-08-04 21:41:25] spam2 at rhsoft dot net
you clearly did not understand what I was talking about: with control chars in a text file it is
possible that a simple "cat filename" leads to execute code sequences in the shell and
some time ago there was even a CVE for mod_security lacking proper escapeing leading to execute code
by just display the log file
------------------------------------------------------------------------
[2017-08-04 18:54:08] philipp at redfish-solutions dot com
> and error_log() should also take care of non-printable characters because otherwise it's
> possible to trigger logfiles with control chars and that can lead in "cat logifle"
> unexpected executes code from untrusted input part of the logging
I'm not sure that's a real problem. Why would anyone be executing log files?
And even if they did, it's not enough to have "magic contents" in a file to be a
problem, they also have to be at the correct offset in the file... which would be extremely hard to
guarantee for a log file, since you can't know in advance what's already been logged to
that file.
This seems like a non-issue.
------------------------------------------------------------------------
[2017-08-04 12:19:25] spam2 at rhsoft dot net
and error_log() should also take care of non-printable characters because otherwise it's
possible to trigger logfiles with control chars and that can lead in "cat logifle"
unexpected executes code from untrusted input part of the logging
------------------------------------------------------------------------
[2017-08-04 11:54:03] krakjoe@php.net
The fix is in the wrong place. The fix should be to modify the php_syslog function to conform with
expectations. I believe a more robust fix would be preferable ...
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=74860
--
Edit this bug report at https://bugs.php.net/bug.php?id=74860&edit=1