CVE-2012-0788: Input Validation

Q: What is the severity of CVE-2012-0788?

CVE-2012-0788 has a medium severity rating.

Q: How do I fix CVE-2012-0788?

To fix CVE-2012-0788, upgrade your PHP version to 5.3.9 or later.

Q: Which versions of PHP are affected by CVE-2012-0788?

CVE-2012-0788 affects PHP versions up to 5.3.8 and various 5.0.x and 5.1.x versions.

Q: What type of vulnerability is CVE-2012-0788?

CVE-2012-0788 is a session-related vulnerability impacting the PDO extension in PHP.

Q: Can CVE-2012-0788 lead to data breaches?

Yes, CVE-2012-0788 can potentially lead to premature session termination and data leakage.

Published Jan 21, 2012

Updated

https://bugs.php.net/bug.php?id=55776

[2011-09-24 19:21 UTC] grinyad at mail dot ru

Description: ------------ <?php

// make a PdoMysql statement before

$result = $stmt->fetch(PDO::FETCHLAZY);

sessionstart();

$SESSION['PDORow'] = $result; ?>

Is crashing on next request after saving PDORow to session on sessionstart()

[2011-09-24 19:24 UTC] aharvey

What do you mean by "crashing"? Is the actual PHP process crashing, or are you just getting an error message because PDO statements aren't serialisable (which is expected)?

[2011-09-25 08:56 UTC] grinyad at mail dot ru

Is a Apache crash. It gives a CGI/FastCGI Send/Don't Send window.

http://img171.imageshack.us/img171/3953/57126366.jpg

After few minutes is crashing apache server:

http://img840.imageshack.us/img840/2981/21231006.jpg

[2011-09-25 12:39 UTC] johannes

PDORow objects may not be serialized and therefore not be put in a session. In svn it was fixed to throw a warning and not crash anymore this will be in future releases.

Other sources

The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the sessionstart function, as demonstrated by a crash of the Apache HTTP Server.

— MITRE

Affected Software

46 affected componentsFixes available

redhat/php<5.3.9

5.3.9

PHP PHP<=5.3.8

PHP PHP=5.0.0

PHP PHP=5.0.0-beta1

PHP PHP=5.0.0-beta2

PHP PHP=5.0.0-beta3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0-rc1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.0-rc3

PHP PHP=5.0.1

PHP PHP=5.0.2

PHP PHP=5.0.3

PHP PHP=5.0.4

PHP PHP=5.0.5

PHP PHP=5.1.1

PHP PHP=5.1.2

PHP PHP=5.1.3

PHP PHP=5.1.4

PHP PHP=5.1.5

PHP PHP=5.1.6

PHP PHP=5.2.0

PHP PHP=5.2.1

PHP PHP=5.2.2

PHP PHP=5.2.3

PHP PHP=5.2.4

PHP PHP=5.2.5

PHP PHP=5.2.6

PHP PHP=5.2.7

PHP PHP=5.2.8

PHP PHP=5.2.9

PHP PHP=5.2.10

PHP PHP=5.2.11

PHP PHP=5.2.12

PHP PHP=5.2.14

PHP PHP=5.2.15

PHP PHP=5.2.16

PHP PHP=5.2.17

PHP PHP=5.3.0

PHP PHP=5.3.1

PHP PHP=5.3.2

PHP PHP=5.3.3

PHP PHP=5.3.4

PHP PHP=5.3.5

PHP PHP=5.3.6

PHP PHP=5.3.7

Event History

Jan 21, 2012

Data Sourced

via Red Hat·12:16 AM

DescriptionSeverityAffected Software

Feb 14, 2012

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0788?

CVE-2012-0788 has a medium severity rating.

How do I fix CVE-2012-0788?