On 9/24/11 6:56 AM, Vincent Danen wrote:
Could a CVE be assigned for this flaw? PHP 5.3.7 changed how the is_a()
function worked, and as a result it could allow for remote arbitrary
code execution if certain specific conditions are met (the blog post
referenced below has a good writeup of the flaw).
I don't see what is to assign CVE to. Almost any function dealing with
classes as strings (including new $foo operator) can result in autoloader
call. If your autoloader is broken and your security practices are
non-existant, this can cause remote code execution. Just as if you write in
your script eval($_GET['hackme']), it can lead to remote code execution. It
is not a flaw in PHP, _GET or eval() function - it is a flaw in how you use
them. You should not be using them this way, and if you have autoloader that
does includes, you should check what are you including and set
allow_url_includes to Off.
It looks like this is the fix:
This is not a "fix" - it is a reversal of BC break because it should not be
introduced in 5.3 version.