Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 384301 (CVE-2011-3379) - <dev-lang/php-5.3.9: is_a() Change in Functional Behaviour Security Issue (CVE-2011-3379)
Summary: <dev-lang/php-5.3.9: is_a() Change in Functional Behaviour Security Issue (CV...
Status: RESOLVED FIXED
Alias: CVE-2011-3379
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal critical (vote)
Assignee: Gentoo Security
URL: https://bugs.php.net/bug.php?id=55475
Whiteboard: A1 [glsa]
Keywords:
Depends on:
Blocks: CVE-2011-4885 CVE-2011-4566
  Show dependency tree
 
Reported: 2011-09-24 14:35 UTC by Sean Amoss (RETIRED)
Modified: 2012-09-24 00:27 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sean Amoss (RETIRED) gentoo-dev Security 2011-09-24 14:35:07 UTC
PHP 5.3.7 changed how the is_a() function worked, and as a result it could allow for remote arbitrary code execution if certain specific conditions are met (the blog post referenced below has a good writeup of the flaw). 

http://www.byte.nl/blog/2011/09/23/security-bug-in-is_a-function-in-php-5-3-7-5-3-8/

The upstream bug at $URL contains a patch.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2011-11-16 23:34:30 UTC
CVE-2011-3379 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3379):
  The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload
  function, which makes it easier for remote attackers to execute arbitrary
  code by providing a crafted URL and leveraging potentially unsafe behavior
  in certain PEAR packages and custom autoloaders.
Comment 2 Agostino Sarubbo gentoo-dev 2011-11-18 11:52:27 UTC
@php

The patch is at $URL, please bump it
Comment 3 Ole Markus With (RETIRED) gentoo-dev 2011-12-15 22:08:07 UTC
Sorry for taking so long commenting on this.

Some comments from Matti and I:

Firstly, the attack vector for this exploit is somewhat theoretical as it requires the programmer to write multiple sets of bad user land code, i.e installing this package in itself does not compromise your system.

Secondly, PHP will release a version expected by the end of the next week which reverts the is_a behaviour. Not because of the related security issue, but because it breaks certain PEAR packages in ours and Ubuntu's tree. The bug mentions that current behaviour will be kept in 5.4 tho, but I did not check if this is really the case and upstream have not added any documentation about this in their reference.
Comment 4 Ole Markus With (RETIRED) gentoo-dev 2012-01-11 06:41:16 UTC
5.3.9 containing the revert of is_a behaviour has been released.

"Fixed bug #55475 (is_a() triggers autoloader, new optional 3rd argument to
is_a and is_subclass_of). (alan_k)"

Cheers,
Ole Markus
Comment 5 Tim Sammut (RETIRED) gentoo-dev 2012-01-11 07:14:47 UTC
(In reply to comment #4)
> 5.3.9 containing the revert of is_a behaviour has been released.
> 

Shall we move forward to stabilization now via this bug? Tnx!
Comment 6 Ole Markus With (RETIRED) gentoo-dev 2012-01-11 20:56:02 UTC
I even got suhosin into this release (thanks to Hanno), so all good from my side.
Comment 7 Tim Sammut (RETIRED) gentoo-dev 2012-01-11 20:57:23 UTC
Great, thanks.

Arches, please test and mark stable:
=dev-lang/php-5.3.9
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Comment 8 Agostino Sarubbo gentoo-dev 2012-01-11 22:57:19 UTC
amd64 stable
Comment 9 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2012-01-12 17:31:36 UTC
x86 stable
Comment 10 Raúl Porcel (RETIRED) gentoo-dev 2012-01-14 18:29:00 UTC
alpha/arm/ia64/s390/sh/sparc stable
Comment 11 Mark Loeser (RETIRED) gentoo-dev 2012-01-16 20:24:13 UTC
ppc/ppc64 done
Comment 12 Jeroen Roovers (RETIRED) gentoo-dev 2012-01-17 05:19:19 UTC
Stable for HPPA.
Comment 13 Agostino Sarubbo gentoo-dev 2012-01-17 08:58:19 UTC
Filed new glsa request
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2012-09-24 00:27:18 UTC
This issue was resolved and addressed in
 GLSA 201209-03 at http://security.gentoo.org/glsa/glsa-201209-03.xml
by GLSA coordinator Sean Amoss (ackle).