[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
This bug was fixed in the package php5 - 5.3.10-1ubuntu3.5 --- php5 (5.3.10-1ubuntu3.5) precise-security; urgency=low * SECURITY UPDATE: arbitrary memory disclosure (LP: #1099793) - debian/patches/CVE-2012-6113.patch: properly initialize length in ext/openssl/openssl.c. - CVE-2012-6113 -- Marc Deslauriers marc.deslauri...@ubuntu.com Fri, 18 Jan 2013 09:49:22 -0500 ** Changed in: php5 (Ubuntu Precise) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
Introduced in 5.3.9 by: http://git.php.net/?p=php- src.git;a=commitdiff;h=095cbc48a8f0090f3b0abc6155f2b61943c9eafb Fixed in 5.3.14 by: http://git.php.net/?p=php- src.git;a=commitdiff;h=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
CVE requested: http://www.openwall.com/lists/oss-security/2013/01/18/5 -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
Sorry, wrong bug. ** Bug watch added: Debian Bug tracker #698446 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698446 ** Also affects: php5 (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698446 Importance: Unknown Status: Unknown ** No longer affects: php5 (Debian) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2012-6113 ** Also affects: php5 (Ubuntu Precise) Importance: Undecided Status: New ** Also affects: php5 (Ubuntu Quantal) Importance: Undecided Status: New ** Also affects: php5 (Ubuntu Raring) Importance: Undecided Status: New ** Changed in: php5 (Ubuntu Quantal) Status: New = Fix Released ** Changed in: php5 (Ubuntu Raring) Status: New = Fix Released ** Changed in: php5 (Ubuntu Precise) Status: New = Confirmed ** Changed in: php5 (Ubuntu Precise) Importance: Undecided = Medium -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
** Changed in: php5 (Ubuntu) Status: Fix Released = Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
** Changed in: php5 (Ubuntu Raring) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
** Changed in: php5 (Ubuntu Precise) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
Thanks Robie! Is there any tutorial to build a deb package on Ubuntu? (or which command have You used to packaging?) I want to build my own php5 deb package if nothing happens till the end of week. :-) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
Bad news: I am trying to complie PHP 5.3.10 on my 12.04 LTS but doesn't work. :-( $apt-get source php5 $cd php5-5.3.10 $./configure --with-openssl $make /bin/sh /tmp/php5-5.3.10/libtool --silent --preserve-dup-deps --mode=compile gcc -Iext/date/lib -Iext/date/ -I/tmp/php5-5.3.10/ext/date/ -DPHP_ATOM_INC -I/tmp/php5-5.3.10/include -I/tmp/php5-5.3.10/main -I/tmp/php5-5.3.10 -I/tmp/php5-5.3.10/ext/date/lib -I/tmp/php5-5.3.10/ext/ereg/regex -I/usr/include/libxml2 -I/tmp/php5-5.3.10/ext/sqlite3/libsqlite -I/tmp/php5-5.3.10/TSRM -I/tmp/php5-5.3.10/Zend-I/usr/include -g -O2 -fvisibility=hidden -c /tmp/php5-5.3.10/ext/date/php_date.c -o ext/date/php_date.lo /tmp/php5-5.3.10/libtool: 481: /tmp/php5-5.3.10/libtool: CDPATH: not found libtool: Version mismatch error. This is libtool 2.4 Debian-2.4-2ubuntu1, but the libtool: definition of this LT_INIT comes from an older release. libtool: You should recreate aclocal.m4 with macros from libtool 2.4 Debian-2.4-2ubuntu1 libtool: and run autoconf again. make: *** [ext/date/php_date.lo] Error 63 I'm not familiar with libtool... Can anyone build (compile) PHP 5.3.10 source on Precise? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
I have successfully built PHP 5.4.10 (latest version from http://php.net) on 12.04. This PHP version is not affected by the bug. :-) Could anyone confirm the bug on stock ubuntu 12.04 system? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
Confirmed, and I've found the fix. This is https://bugs.php.net/bug.php?id=61413 fixed in http://git.php.net/?p =php-src.git;a=commit;h=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e and released upstream in 5.3.14. This is due to i remaining uninitialised in the case of input data of zero size. I also think this is a security issue, since it results in the encrypted data containing arbitrary memory contents which could subsequently be leaked to a web user. This could contain things like a mysql password or other secrets. The attached debdiff fixes this bug. I've tested that it builds and upgrading fixes the issue. Adding ~ubuntu-security-sponsors and removing importance for re-triaging by the security team. ** Bug watch added: bugs.php.net/ #61413 http://bugs.php.net/bug.php?id=61413 ** Patch added: php5.debdiff https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+attachment/3484103/+files/php5.debdiff ** Changed in: php5 (Ubuntu) Importance: Medium = Undecided ** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1099793] Re: php 5.3.10 openssl_encrypt empty data
If this doesn't qualify as security issue then I think we should SRU this instead. Build log attached from my test. ** Attachment added: php5_5.3.10-1ubuntu3.5_amd64.build https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+attachment/3484104/+files/php5_5.3.10-1ubuntu3.5_amd64.build -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1099793 Title: php 5.3.10 openssl_encrypt empty data To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
