Bug 252682 (CVE-2008-5694) – dev-php5/jpgraph jpgraph_errhandler.inc.php LFI vulnerability (CVE-2008-5694)

• Product: Gentoo Security
• Status: RESOLVED NEEDINFO

[Description Robert Buchholz (RETIRED) 2008-12-27 13:27:50 UTC]

CVE-2008-5694 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5694):
  PHP remote file inclusion vulnerability in
  lib/jpgraph/jpgraph_errhandler.inc.php in Sandbox 1.4.1 might allow
  remote attackers to execute arbitrary PHP code via unspecified
  vectors.  NOTE: the issue, if any, may be located in Aditus JpGraph
  rather than Sandbox. If so, then this should not be treated as an
  issue in Sandbox.

[Comment 1 Robert Buchholz (RETIRED) 2008-12-27 13:31:06 UTC]

Unfortunately, the advisory is only available at http://www.by-f10.com/bug.txt and I could not find a copy and the server is unavailable. Let's track this issue as unconfirmed for now.

I did not thoroughly review the code, but there is no obvious RFI there.

[Comment 2 Christian Hoffmann (RETIRED) 2008-12-27 15:09:56 UTC]

Cannot find the contents of the advisory URL anywhere either and had a quick look at the code myself...
jpgraph itself is not vulnerable, i.e. just by having jpgraph installed nobody will be able to exploit the issue.
We are talking about a local file inclusion vulnerability here, btw, not remote. And maybe XSS, because the filename becomes part of an error message in case of an error.
Any application which calls JpGraphError::SetErrLocale() with untrusted user input may be vulnerable to this issue, but to actually execute PHP code an attacker has to place the code as a file on the system somehow (image upload functionality or similar).
Depending on how the used libc handles \0 bytes, the attack may be limited to files ending with .inc.php anyway, so...

Still, a fix should probably be applied to jpgraph.

[Comment 3 Chris Reffett (RETIRED) 2013-09-03 02:48:21 UTC]

Even the CVE doesn't have much information beyond this affecting an old version of sandbox (long gone from tree). Closing NEEDINFO.