Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57866
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain sury.org designates 209.85.220.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4F3A5B70.3020707@co3k.org>
References: <4F3A5B70.3020707@co3k.org>
Date: Tue, 14 Feb 2012 15:03:56 +0100
Message-ID: <CALjhHG8RG_36Vh9oJ6mBtObfrQvR=tegYiaKqr_cqJpRWDGK-g@mail.gmail.com>
To: Kousuke Ebihara <kousuke@co3k.org>
Cc: internals@lists.php.net, ondrej@php.net
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: About CVE-2012-0831 (magic_quotes_gpc remote disable vulnerability?)
From: ondrej@sury.org (=?UTF-8?B?T25kxZllaiBTdXLDvQ==?=)

2012/2/14 Kousuke Ebihara <kousuke@co3k.org>:
> Hi,
>
> I've noticed the following CVE:
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2012-0831
>
>> PHP before 5.3.10 does not properly perform a temporary change to the ma=
gic_quotes_gpc directive during the importing of environment variables, whi=
ch makes it easier for remote attackers to conduct SQL injection attacks vi=
a a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, =
and sapi/fpm/fpm/fpm_main.c.

That's some noise on the wire...  This fix was never part of PHP
5.3.10 and I think all security team just copied this information from
CVE. (Now I at least know where they got it.)

And you really need to pull the patch from
https://bugs.php.net/bug.php?id=3D61043 before you push out 5.3.11.

O.
--=20
=EF=BB=BFOnd=C5=99ej Sur=C3=BD <ondrej@sury.org>