Re: CVE request: is_a() function may allow arbitrary code execution in PHP 5.3.7/5.3.8

[Pierre Joye <pierre.php () gmail com>]

hi,

On Sun, Sep 25, 2011 at 1:22 AM, Stas Malyshev <smalyshev () sugarcrm com> wrote:
> Hi!
>
> On 9/24/11 6:56 AM, Vincent Danen wrote:
> > Could a CVE be assigned for this flaw?  PHP 5.3.7 changed how the is_a()
> > function worked, and as a result it could allow for remote arbitrary
> > code execution if certain specific conditions are met (the blog post
> > referenced below has a good writeup of the flaw).
>
> I don't see what is to assign CVE to. Almost any function dealing with
> classes as strings (including new $foo operator) can result in autoloader
> call. If your autoloader is broken and your security practices are
> non-existant, this can cause remote code execution. Just as if you write in
> your script eval($_GET['hackme']), it can lead to remote code execution. It
> is not a flaw in PHP, _GET or eval() function - it is a flaw in how you use
> them. You should not be using them this way, and if you have autoloader that
> does includes, you should check what are you including and set
> allow_url_includes to Off.
>
> > http://www.byte.nl/blog/2011/09/23/security-bug-in-is_a-function-in-php-5-3-7-5-3-8/
> > https://bugs.php.net/bug.php?id=55475
> > https://bugzilla.redhat.com/show_bug.cgi?id=741020
> >
> > It looks like this is the fix:
> >
> > http://svn.php.net/viewvc/?view=revision&amp;revision=317183
>
> This is not a "fix"  - it is a reversal of BC break because it should not be
> introduced in 5.3 version.

It breaks the checks which leads to autoloader to accept bad input.
Yes, the autoloader should have sanity check in place but this BC
break changes the behavior and introduced this issue as well on top of
it.

I'm not sure either if we need a CVE as it is not a flaw in php itself
per se. However the BC break introduces flaws in working codes, and
that's a gray zone now.

Cheers,
-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org