CVE-2015-3307: Buffer Overflow

First published: Wed May 20 2015(Updated: )

A vulnerability in PHP was reported whereby the Heap header gets misaligned resulting in the corruption of the heap chunk's metadata. A heap chunk is allocated in ext/phar/tar.c:167 metadata = (char *) safe_emalloc(1, entry->uncompressed_filesize, 1); A reference to this heap chunk is passed into phar_parse_metadata() at ext/phar/tar.c:176 if (phar_parse_metadata(&metadata, &entry->metadata, entry->uncompressed_filesize TSRMLS_CC) == FAILURE) { The following gets called within phar_parse_metadata:611 when zip_metadata_len==0 PHAR_GET_32(*buffer, buf_len); This moves the pointer referencing the heap chunk by 4 bytes. When the heap chunk gets freeed at at tar.c:177: efree(metadata); The heap chunk is now misaligned by 4 bytes. In other words: ZEND_MM_HEADER_OF(metadata).info._size is now ZEND_MM_HEADER_OF(metadata).info._prev and ZEND_MM_HEADER_OF(metadata).info._prev is tainted with the body's data. Upstream bug: <a href="https://bugs.php.net/bug.php?id=69443">https://bugs.php.net/bug.php?id=69443</a> Upstream patch: <a href="http://git.php.net/?p=php-src.git;a=commitdiff;h=17cbd0b5b78a7500f185b3781a2149881bfff8ae">http://git.php.net/?p=php-src.git;a=commitdiff;h=17cbd0b5b78a7500f185b3781a2149881bfff8ae</a> This patch was for <a href="https://access.redhat.com/security/cve/CVE-2015-2783">CVE-2015-2783</a> (<a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2015-2783 php: buffer over-read in Phar metadata parsing" href="show_bug.cgi?id=1213446">bug 1213446</a>), but it inadvertently resolved this vulnerability as well. The vulnerable line that was removed was on ext/phar/phar.c:611 PHAR_GET_32(*buffer, buf_len);

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
redhat/php	<5.4.40	5.4.40
redhat/php	<5.5.24	5.5.24
redhat/php	<5.6.8	5.6.8
Redhat Enterprise Linux Desktop	=7.0
Redhat Enterprise Linux Hpc Node	=7.0
Redhat Enterprise Linux Hpc Node Eus	=7.1
Redhat Enterprise Linux Server	=7.0
Redhat Enterprise Linux Server Eus	=7.1
Redhat Enterprise Linux Workstation	=7.0
Redhat Enterprise Linux	=6.0
Redhat Enterprise Linux	=7.0
Apple Mac OS X	<=10.10.4
PHP PHP	<=5.4.39
PHP PHP	=5.5.0
PHP PHP	=5.5.0-alpha1
PHP PHP	=5.5.0-alpha2
PHP PHP	=5.5.0-alpha3
PHP PHP	=5.5.0-alpha4
PHP PHP	=5.5.0-alpha5
PHP PHP	=5.5.0-alpha6
PHP PHP	=5.5.0-beta1
PHP PHP	=5.5.0-beta2
PHP PHP	=5.5.0-beta3
PHP PHP	=5.5.0-beta4
PHP PHP	=5.5.0-rc1
PHP PHP	=5.5.0-rc2
PHP PHP	=5.5.1
PHP PHP	=5.5.2
PHP PHP	=5.5.3
PHP PHP	=5.5.4
PHP PHP	=5.5.5
PHP PHP	=5.5.6
PHP PHP	=5.5.7
PHP PHP	=5.5.8
PHP PHP	=5.5.9
PHP PHP	=5.5.10
PHP PHP	=5.5.11
PHP PHP	=5.5.12
PHP PHP	=5.5.13
PHP PHP	=5.5.14
PHP PHP	=5.5.18
PHP PHP	=5.5.19
PHP PHP	=5.5.20
PHP PHP	=5.5.21
PHP PHP	=5.5.22
PHP PHP	=5.5.23
PHP PHP	=5.6.0-alpha1
PHP PHP	=5.6.0-alpha2
PHP PHP	=5.6.0-alpha3
PHP PHP	=5.6.0-alpha4
PHP PHP	=5.6.0-alpha5
PHP PHP	=5.6.0-beta1
PHP PHP	=5.6.0-beta2
PHP PHP	=5.6.0-beta3
PHP PHP	=5.6.0-beta4
PHP PHP	=5.6.2
PHP PHP	=5.6.3
PHP PHP	=5.6.4
PHP PHP	=5.6.5
PHP PHP	=5.6.6
PHP PHP	=5.6.7

CVE-2015-3307: Buffer Overflow

Remedy

Remedy

Never miss a vulnerability like this again

Reference Links

Company

Resources

Contact