PHP 4.0 Bug #6351 Updated: '%'-characters in syslog()-function

ID: 6351 Updated by: stas Reported By: jjaakkol@cs.helsinki.fi Status: Closed Bug Type: *General Issues Assigned To: Comments: fixed in CVS. Previous Comments: --------------------------------------------------------------------------- [2000-08-27 07:29:20] jjaakkol@cs.helsinki.fi This kind of "format bugs" have been exploited before. At least wu-ftpd and proftpd have been vulnerable to format bugs. See BugTraq mailing list last july for details (especially the thread "paper: format bugs"). I don't know for sure if this could be exploided in PHP, but my best guess is that it probably could be. IMHO, the best fix would be to just use syslog("%s",string). You only need five more characters but no change in the PHP-syslog function API. --------------------------------------------------------------------------- [2000-08-27 06:03:48] stas@php.net Seems to be a real bug. We should or require parameters for %-s, or inhibit them at all, and use %s for it. Contrary to what user says, I do not see a way to exploit it actively (like, for modifying any data on the server), but this can easily lead for crash, since garbage pointer is referenced. --------------------------------------------------------------------------- [2000-08-25 08:22:27] jjaakkol@cs.helsinki.fi syslog() function has a client given format string vulneralibity (this is actually known, since there is a comment on this in the sources). # cat test.php <?php syslog(5,"%s"); ?> # php4 test.php Content-type: text/html # tail -1 /var/log/messages Aug 25 15:05:12 demonstration php4: U?åfì^HVS<u^Lf}^H^Bu^W?EüP?EøPj^BèÄ^^A However, I guess that this could be exploited to gain access to PHP-server in scripts who syslog() some client given data. So this is a security problem too. The simple fix is to change the line php_syslog((*priority)->value.lval, (*message)->value.str.val); in ext/standard/syslog.c to php_syslog((*priority)->value.lval,"%s", (*message)->value.str.val); --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6351