PHP Function CRLF Injection

2003-09-09T00:00:00
ID OSVDB:2160
Type osvdb
Reporter OSVDB
Modified 2003-09-09T00:00:00

Description

Vulnerability Description

A flaw exists in PHP which may allow an attacker to add arbitrary data to headers constructed by PHP when remote resources are referenced using these functions. In this way, a PHP script which uses the vulnerable function with the allow_url_fopen() directive enabled may be turned into a proxy, since the attacker is able to construct an arbitrary header to be sent with the request. This may be accomplished by building an arbitrary header using CRLF injection.

Solution Description

It is possible to mitigate this issue by disabling the "allow_url_fopen" directive in the PHP configuration. It is also possible to sanitize variables used as URLs in the vulnerable functions using the following regular expression:

$var = preg_replace('/\s+/', ', $var);

The vendor has made a source code fix available via the CVS repository.

Mandrake has released a new security advisory, (MDKSA-2003:082). Information on obtaining and applying fixes can be found in the referenced advisory.

OpenPKG has released a new security advisory, OpenPKG-SA-2003.032. Information on obtaining and applying fixes can be found in the referenced advisory.

Conectiva has released an advisory (CLA-2002:545) which contains fixes for this issue. Please see the attached advisory for further details on obtaining fixes.

RedHat has released a security advisory, RHSA-2002:213-06. Information on obtaining and applying fixes can be found in the referenced advisory.

HP has released an advisory for HP Secure OS, and has advised users to upgrade using the packages listed in Red Hat Security Advisory RHSA-2002:213-06.

Short Description

A flaw exists in PHP which may allow an attacker to add arbitrary data to headers constructed by PHP when remote resources are referenced using these functions. In this way, a PHP script which uses the vulnerable function with the allow_url_fopen() directive enabled may be turned into a proxy, since the attacker is able to construct an arbitrary header to be sent with the request. This may be accomplished by building an arbitrary header using CRLF injection.

References:

Vendor Specific Advisory URL Related OSVDB ID: 2111 Mail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=103011916928204&w=2 Generic Informational URL: http://www.securityfocus.com/advisories/4486 Generic Informational URL: http://www.securityfocus.com/advisories/5056 Generic Informational URL: http://www.securityfocus.com/advisories/4699 CVE-2002-0986 Bugtraq ID: 5681