CVE-2013-6501: Medium severity php vulnerability

On http://git.php.net/?p=php-src.git;a=blob;f=ext/soap/phpsdl.c;h=0ac4c2ed7a9bf87bb454db58ae3d969eef36f244;hb=HEAD#l3224

We see that php wdsl extension is reading predictible filename from a cache directory. The name is based on a configurable directory name, a prefix, and a md5, md5 derived for the file that would be cached ( or rather the url ).

So far, so good. However, default configuration is to use /tmp : http://www.php.net/manual/en/soap.configuration.php#ini.soap.wsdl-cache-dir

so someone could connect to a shared php server ( not uncommon ), and if some php code is using this feature ( ie, using wsdl ), with cache enabled by default ,it could just pre-create the file in /tmp to have it used instead of the one intended to be used ( ie, a cache injection issue ). After a quick look, there is no check of owner or permission in getsdlfromcache.

I am not able to say if WSDL injection is a serious issue or not.

Fedora do have PrivateTmp in systemd file, that mitigate this issue ( provided someone do not use php to make the attack ). RHEL < 7 do not have it however.

So far, upstream was not notified, except our php maintainer for a quick sanity check. I assume this affect all php version since a few years.