CVE-2013-6420: Buffer Overflow

Q: What is the severity of CVE-2013-6420?

CVE-2013-6420 has been classified as a high severity vulnerability due to the potential for remote code execution via crafted X.509 certificates.

Q: How do I fix CVE-2013-6420?

To fix CVE-2013-6420, upgrade your PHP installation to version 5.5.7 or later for 5.5.x, 5.4.23 or later for 5.4.x, or 5.3.28 or later for 5.3.x.

Q: What versions of PHP are affected by CVE-2013-6420?

CVE-2013-6420 affects PHP versions 5.3.0 to 5.3.27, 5.4.0 to 5.4.22, and 5.5.0 to 5.5.6.

Q: Can CVE-2013-6420 be exploited remotely?

Yes, CVE-2013-6420 can be exploited by remote attackers through the use of crafted self-signed X.509 certificates.

Q: Is there a workaround for CVE-2013-6420?

There is no effective workaround for CVE-2013-6420; the best mitigation is to update to a patched version of PHP.

Published Dec 2, 2013

Updated

Stefan Esser reported a vulnerability in the PHP openssl extension. A memory corruption flaw was found in the way the opensslx509parse() function of the PHP openssl extension parsed X.509 certificates. A remote attacker could use this flaw to provide a malicious self-signed certificate or a certificate signed by a trusted authority to a PHP application using the aforementioned function, causing the application to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the user running the PHP interpreter.

Acknowledgements:

Red Hat would like to thank the PHP project for reporting this issue. Upstream acknowledges Stefan Esser as the original reporter of this issue.

Other sources

The asn1timetotimet function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the opensslx509parse function.

— MITRE

Affected Software

84 affected componentsFixes available

redhat/php<5.5.7

5.5.7

redhat/php<5.4.23

5.4.23

redhat/php<5.3.28

5.3.28

PHP PHP=5.4.0

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

PHP PHP=5.4.12-rc1

PHP PHP=5.4.12-rc2

PHP PHP=5.4.13

PHP PHP=5.4.13-rc1

PHP PHP=5.4.14

PHP PHP=5.4.14-rc1

PHP PHP=5.4.15

PHP PHP=5.4.15-rc1

PHP PHP=5.4.16

PHP PHP=5.4.16-rc1

PHP PHP=5.4.17

PHP PHP=5.4.18

PHP PHP=5.4.19

PHP PHP=5.4.20

PHP PHP=5.4.21

PHP PHP=5.4.22

openSUSE openSUSE=11.4

openSUSE openSUSE=12.2

openSUSE openSUSE=12.3

openSUSE openSUSE=13.1

Apple iOS and macOS<=10.9.1

PHP PHP<=5.3.27

PHP PHP=5.3.0

PHP PHP=5.3.1

PHP PHP=5.3.2

PHP PHP=5.3.3

PHP PHP=5.3.4

PHP PHP=5.3.5

PHP PHP=5.3.6

PHP PHP=5.3.7

PHP PHP=5.3.8

PHP PHP=5.3.9

PHP PHP=5.3.10

PHP PHP=5.3.11

PHP PHP=5.3.12

PHP PHP=5.3.13

PHP PHP=5.3.14

PHP PHP=5.3.15

PHP PHP=5.3.16

PHP PHP=5.3.17

PHP PHP=5.3.18

PHP PHP=5.3.19

PHP PHP=5.3.20

PHP PHP=5.3.21

PHP PHP=5.3.22

PHP PHP=5.3.23

PHP PHP=5.3.24

PHP PHP=5.3.25

PHP PHP=5.3.26

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 5.5.7
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 5.4.23
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 5.3.28

Event History

Dec 17, 2013

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·04:46 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-6420?

CVE-2013-6420 has been classified as a high severity vulnerability due to the potential for remote code execution via crafted X.509 certificates.

How do I fix CVE-2013-6420?