PHP up to 7.1.26/7.3.2 ext/phar/tar.c phar_tar_writeheaders_int memory corruption ⚔ [Disputed]

Summaryinfo

A vulnerability has been found in PHP up to 7.1.26/7.3.2 and classified as problematic. This impacts the function phar_tar_writeheaders_int of the file ext/phar/tar.c. Performing a manipulation results in memory corruption. This vulnerability is reported as CVE-2019-9675. The attack is possible to be carried out remotely. No exploit exists. The presence of this vulnerability remains uncertain at this time. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in PHP up to 7.1.26/7.3.2 (Programming Language Software). This affects the function phar_tar_writeheaders_int of the file ext/phar/tar.c. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

** DISPUTED ** An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible."

The weakness was disclosed 03/11/2019 (Website). It is possible to read the advisory at lists.opensuse.org. This vulnerability is uniquely identified as CVE-2019-9675 since 03/11/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The real existence of this vulnerability is still doubted at the moment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 172199 (SUSE Enterprise Linux Security Update for php53 (SUSE-SU-2019:14013-1)).

Upgrading to version 7.1.27 or 7.3.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 108177†). The entries VDB-131077, VDB-131531, VDB-131532 and VDB-131533 are pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• PHP

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9
• 7.1.10
• 7.1.11
• 7.1.12
• 7.1.13
• 7.1.14
• 7.1.15
• 7.1.16
• 7.1.17
• 7.1.18
• 7.1.19
• 7.1.20
• 7.1.21
• 7.1.22
• 7.1.23
• 7.1.24
• 7.1.25
• 7.1.26
• 7.3.0
• 7.3.1
• 7.3.2

License

• open-source

Website

• Product: https://www.php.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion