[Bug 315507] Re: [jaunty] php5-odbc module broken
Hi Chuck, I've set up a karmic alpha 5 amd64 test server on virtualbox. r...@karmic:/var/www# uname -a Linux karmic 2.6.31-9-server #29-Ubuntu SMP Sun Aug 30 18:37:42 UTC 2009 x86_64 GNU/Linux r...@karmic:~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description:Ubuntu karmic (development branch) Release:9.10 Codename: karmic everything updated to the latest version available: r...@karmic:/var/www# dpkg-query -W apache2 libapache2-mod-php5 libmyodbc php5-common php5-odbc apache2 2.2.12-1ubuntu2 libapache2-mod-php5 5.2.10.dfsg.1-2ubuntu2 libmyodbc 3.51.19r646-1 php5-common 5.2.10.dfsg.1-2ubuntu2 php5-odbc 5.2.10.dfsg.1-2ubuntu2 created a test page to connect to a mysql server I have on another VM and... everything works just fine! NO canary mismatches, yay! :) I'll be able to do some more tests when I'll be at work next week. Let me know If you need something else. -- [jaunty] php5-odbc module broken https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
http://chrisblunt.com/blog/2009/05/01/php-fixing-mismatched-canaries- how-to-remove-suhosin-from-debianubuntu-packages/ here the guy talks about mssql_query causing the canary mismatch. -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
Jonathan, thanks for taking the time to post an exhaustive reply. I'm creating a new VM right now to do a complete test as you suggested, but as that's not going to reproduce our real world situation, I'm going to post the details of the actual machine where the thing is happening. Later on I'll post the results from the complete test on the new vm. The server is a vmware esxi 4 VM (like the new vm I'm creating). Ubuntu release: # lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description:Ubuntu 8.04.2 Release:8.04 Codename: hardy Packages version (note: I don't have php5-cli installed): # dpkg-query -W apache2 libapache2-mod-php5 libmyodbc php5-common php5-odbc apache2 2.2.8-1ubuntu0.10 libapache2-mod-php5 5.2.4-2ubuntu5.6 libmyodbc 3.51.15r409-2 php5-common 5.2.4-2ubuntu5.6 php5-odbc 5.2.4-2ubuntu5.6 This is the last request from apache2 log (/var/log/apache2/error.log) and syslog: [Mon Jul 20 08:42:55 2009] [error] [client ip here] ALERT-SIMULATION - canary mismatch on efree() - heap overflow detected (attacker 'ip here', file '/var/www/services/reports/odbc.php') Note that even if it shows ALERT-SIMULATION I still get the php script offered for download. Of course the same thing applies without simulation mode on (except it shows ALERT without the -SIMULATION). Note also that I've tried to run the script both without and with the suhosin extension (php5-suhosin). The test script is basically: $connection = odbc_connect($dsn, $user, $pass); $result = odbc_exec(select * from table); Then there is the while to loop on the resultset, but the script hangs on the odbc_exec line (tested by deleting one line at the time until I got no error). The mysql server is on another (phisical) machine. I've tested the connection and the same query with isql and everything works fine. Oh and everything is on https (I can test with http if needed). If I missed something or you need more info, just ask. Thanks. -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
erhm, of course in my test script in the odbc_exec function I've specified the connection parameter, I just missed it here in the comment. -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
Darn there should be an edit function for comments here... I forgot to mention an essential thing, the ubuntu release is the AMD64 one. -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
Ok I was able to reproduce the problem on a new VM Steps: 1) Create fresh vm: done, installed Ubuntu 8.04.2 amd64 as denoted by # lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description:Ubuntu 8.04.3 LTS (it shows .3 because I issued the command after the update I think) Release:8.04 Codename: hardy 2) Update system and reboot: done 3) Install LAMP Server packages: done. I didn't install mysql, only apache2 and php5 (I have the db on another machine) 4) We need ODBC: done. Installed php5-odbc libmyodbc unixodbc, copied the sample configurations and adapted odbc.ini to connect to my db server. Plus I tested the connection with isql and worked. 5) Create a PHP test page: done. I've attached the info.html file (with ip and domain hidden for privacy reasons) 6) I already have a database ready (MySQL 5.0.24) 7) Create PHP page to test odbc: done. It's the exact copy of your example script, with the connection data and the table changed of course 8) Try the script.. and here the browser serves me the file as a download. In /var/log/apache2/error.log there is the canary error. Here's the complete log: [Mon Jul 20 11:39:37 2009] [notice] Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.6 with Suhosin-Patch configured -- resuming normal operations [Mon Jul 20 11:47:47 2009] [error] [client client ip] ALERT - canary mismatch on efree() - heap overflow detected (attacker 'client ip', file '/var/www/odbctest.php', line 11), referer: http://server ip/ [Mon Jul 20 11:47:47 2009] [error] [client client ip] ALERT - canary mismatch on efree() - heap overflow detected (attacker 'client ip', file '/var/www/odbctest.php', line 11), referer: http://server ip/ 9) and 10) no sense doing these. The issue in not intermittent, it happens every time. 11) Document exact versions of packages: # dpkg-query -W apache2 libapache2-mod-php5 libmyodbc php5-common php5-odbc apache2 2.2.8-1ubuntu0.10 libapache2-mod-php5 5.2.4-2ubuntu5.6 libmyodbc 3.51.15r409-2 php5-common 5.2.4-2ubuntu5.6 php5-odbc 5.2.4-2ubuntu5.6 ** Attachment added: info.html http://launchpadlibrarian.net/29274780/info.html -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
To be honest it wouldn't be a problem for me if the simulation mode actually worked. I don't really mind if the odbc functions are badly coded (or whatever). What I do mind is suhosin breaking my scripts without a way to prevent it which doesn't include recompiling php without the patch. But of course if I can help in debugging the real problem and fix the root of the problem (which of course would be better), hey I'm here :) -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
I've reproduced the problem on a 9.04 amd64 fully updated, same configuration as above. -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
Ondrej, sure as soon as I'm done with this vm I'm building I'll try with i386. It's not that I don't care, but as we're migrating tons of stuff around and this migration has to be finished soon, I really need the odbc thing working asap, so that's why I don't mind the buffer overflow for now, if I can get the thing to work with a workaround. But as I said I'l gladly try my best to solve the root problem because I understand that's not something to be underestimated. Thanks for your help. -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
The error I get is the same StephenA reported: ALERT - canary mismatch on efree() - heap overflow detected (attacker 'ip here', file 'file here') and I get it by calling odbc_execute() or odbc_exec() with any query. The script I used to reproduce the problem is a simple test script with just the db connection and the query. I don't have the logs at hand right now, I'll post them tomorrow. -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 315507] Re: Unable to remove Suhosin patch
I have the same problem as the other guys. And doing: # echo suhosin.simulation = on /etc/php5/conf.d/suhosin.ini Restarting the webserver and you will be fine. does not solve the problem. phpinfo() shows the flag as on, but the php scripts which cause the error still stop being executed and are offered for download. *In my opinion* you shouldn't provide a package with a patch that is known to break code (even if intentionally) without providing an alternative one, say something like php5-no-suhosin, or a way to disable the patch without recompiling the whole package. -- Unable to remove Suhosin patch https://bugs.launchpad.net/bugs/315507 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
