oss-sec mailing list archives
Re: Re: CVE Request - roundcubemail
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Mon, 15 Dec 2008 11:17:01 +0100
Hello guys, On Sat, 2008-12-13 at 13:54 +0100, Florian Weimer wrote:
* Raphael Geissert:I became aware of some sort of code execution vulnerability one day before that ticket was reported. After reviewing the file I determined that it isn't a vulnerability in roundcube, but in PHP itself; but I'm open to be proved wrong.I think this is a documented feature of preg_replace with the "e" flag, comparable to what happens when you use string concatenation to create SQL statements.
Yes, according to: http://bugs.php.net/bug.php?id=35960 the behavior of 'e' modifier in the preg_replace function is expected and well documented feature: http://php.net/manual/en/reference.pcre.pattern.modifiers.php So the problem isn't in PHP itself, the problem is roundcubemail (and possibly other applications) use it in wrong/improper/vulnerable way. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request - roundcubemail Jan Lieskovsky (Dec 12)
- Re: CVE Request - roundcubemail Raphael Geissert (Dec 13)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 13)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 13)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 13)
- Re: Re: CVE Request - roundcubemail Steven M. Christey (Dec 16)
- Re: Re: CVE Request - roundcubemail Jan Lieskovsky (Dec 17)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 17)
- Re: Re: CVE Request - roundcubemail Steven M. Christey (Dec 24)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 28)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 13)
- Re: CVE Request - roundcubemail Raphael Geissert (Dec 13)
- Re: Re: CVE Request - roundcubemail Jan Lieskovsky (Dec 15)
- Re: Re: CVE Request - roundcubemail Florian Weimer (Dec 15)
- Re: Re: CVE Request - roundcubemail Christian Hoffmann (Dec 15)
- Re: Re: CVE Request - roundcubemail Raphael Geissert (Dec 16)