php5-cgi: IMAP toolkit crash

[Luca Lorenzetto]

While using export function in my horde webmail (in order to get a maildir downloaded as mbox file) i get an internal server error and on the php error log i get this:

php5-cgi: IMAP toolkit crash: rfc822.c legacy routine buffer overflow

This bug was released as fixed on USN-628-1 (http://www.ubuntu.com/usn/usn-628-1) as fix for CVE-2008-2829, but as far as i can see, the problem still exists

Here are the os details:

root@posta1:~# lsb_release -rd
Description: Ubuntu 8.04.3 LTS
Release: 8.04
root@posta1:~# dpkg -l php5*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-f/Unpacked/Failed-cfg/Half-inst/t-aWait/T-pend
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Nome Versione Descrizione
+++-====================================-====================================-========================================================================================
ii php5 5.2.4-2ubuntu5.7 server-side, HTML-embedded scripting language (meta-package)
ii php5-cgi 5.2.4-2ubuntu5.7 server-side, HTML-embedded scripting language (CGI binary)
ii php5-cli 5.2.4-2ubuntu5.7 command-line interpreter for the php5 scripting language
ii php5-common 5.2.4-2ubuntu5.7 Common files for packages built from the php5 source
ii php5-curl 5.2.4-2ubuntu5.7 CURL module for php5
ii php5-gd 5.2.4-2ubuntu5.7 GD module for php5
ii php5-imap 5.2.3-0ubuntu3 IMAP module for php5
un php5-json <non definita> (descrizione non disponibile)
ii php5-ldap 5.2.4-2ubuntu5.7 LDAP module for php5
ii php5-mcrypt 5.2.3-0ubuntu1 MCrypt module for php5
ii php5-mhash 5.2.4-2ubuntu5.7 MHASH module for php5
ii php5-mysql 5.2.4-2ubuntu5.7 MySQL module for php5
un php5-mysqli <non definita> (descrizione non disponibile)
ii php5-suhosin 0.9.22-1 advanced protection module for php5
root@posta1:~# apt-cache policy php5-cgi
php5-cgi:
  Installato: 5.2.4-2ubuntu5.7
  Candidato: 5.2.4-2ubuntu5.7
  Tabella versione:
 *** 5.2.4-2ubuntu5.7 0
        500 http://it.archive.ubuntu.com hardy-updates/main Packages
        500 http://security.ubuntu.com hardy-security/main Packages
        100 /var/lib/dpkg/status
     5.2.4-2ubuntu5 0
        500 http://it.archive.ubuntu.com hardy/main Packages

[Luca Falavigna (dktrkranz)]

Jamie, mind having a look at this?

[Luca Lorenzetto (lorenzetto-luca)]

The problem still exists with latest ubuntu php upgrade

root@posta1:~# grep php /var/log/syslog | grep crash
Nov 27 19:42:35 posta1 php5-cgi: IMAP toolkit crash: rfc822.c legacy routine buffer overflow
Nov 27 19:44:11 posta1 php5-cgi: IMAP toolkit crash: rfc822.c legacy routine buffer overflow
root@posta1:~# php-cgi -v
PHP 5.2.4-2ubuntu5.9 with Suhosin-Patch 0.9.6.2 (cgi-fcgi) (built: Nov 26 2009 13:52:47)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies
    with Suhosin v0.9.22, Copyright (c) 2007, by SektionEins GmbH

[Luca Lorenzetto (lorenzetto-luca)]

no one looking at this bug? :-(

[Marc Deslauriers (mdeslaur)]

In Ubuntu, the php imap plugin is in a separate php-imap source package.

Although USN-628-1 says CVE-2008-2829 was fixed, it was a mistake. The actual binary isn't built from the php5 source package.

CVE-2008-2829 needs to be fixed in the php-imap source package that's in universe.

[Launchpad Janitor (janitor)]

This bug was fixed in the package php-imap - 5.2.6-0ubuntu7

---------------
php-imap (5.2.6-0ubuntu7) lucid; urgency=low

  * Add quilt support.
  * SECURITY UPDATE: unsafe usage of deprecated imap functions (LP: #485973)
    - add debian/patches/CVE-2008-2829.diff, patch taken from Debian
    - CVE-2008-2829
  * Bump Standards-Version to 3.8.3.
 -- Devid Antonio Filoni <email address hidden> Wed, 06 Jan 2010 17:40:37 +0100

[Devid Antonio Filoni (d.filoni)]

Debdiff for karmic-security.

[Devid Antonio Filoni (d.filoni)]

debdiff for jaunty-proposed.

[Devid Antonio Filoni (d.filoni)]

debdiff for intrepid-security.

[Devid Antonio Filoni (d.filoni)]

debdiff for hardy-security.

[Devid Antonio Filoni (d.filoni)]

debdiff for dapper-security.

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiffs Devid.

The hardy debdiff is wrong and doesn't compile. Please submit a corrected one. Also, please describe the testing you've performed on these debdiffs.

I have unsubscribed ubuntu-security-sponsors from this bug. Once you've completed the new hardy debdiff and have described the testing, please subscribe ubuntu-security-sponsors again and set the status to "NEW".

Thanks!

[Marc Deslauriers (mdeslaur)]

The dapper debdiff also fails to build. Please re-submit a fixed dapper debdiff also.

[Luca Lorenzetto (lorenzetto-luca)]

I've tested the new package built by d.filoni on karmic on the same environment i used to check the existence of the bug in 9.10. Now, if i try to download the mbox file from horde i get it downloaded without problems and errors on the php error log. So, as far as i can see the bug is fixed.

[Devid Antonio Filoni (d.filoni)]

Hardy debdiff

[Jamie Strandboge (jdstrand)]

Based on my research the patch is incorrect. Lucid has the incorrect patch in it and needs to be updated. You should be using http://svn.php.net/viewvc?view=revision&revision=267399. If this is in error, please resubmit the patches with the correct references for the origin of the patch. Unsubscribing ubuntu-security-sponsors. Please resubscribe ubuntu-security-sponsors and set the status to 'NEW' when the changes are complete.

[Luca Lorenzetto (lorenzetto-luca)]

Sorry Jamie, but i'm not so expert with packaging and co. but, as far as i can see, a package for Karmic built with the patch created by d.filoni solves my problem and php does crashes no more. The bug IS fixed on php and, as far as i can read on the USN, IS ALSO fixed on ubuntu's php sources...

[Jamie Strandboge (jdstrand)]

Luca, you are correct about the USN. The patch in the USN came from Debian but the code in Ubuntu is not built since php-imap is broken out (and therefore, unfortunately, not tested). Looking at the patch, a lot of the differences can be attributed to changing the memory allocation for 'string' from static to dynamic, but there are other changes that are not as clear.

Marc pointed out to me that the patch is from http://patch-tracker.debian.org/patch/series/view/php5/5.2.6.dfsg.1-1+lenny4/CVE-2008-2829.patch. It looks like all of Devid's patches for hardy and later match this patch. I checked the Debian BTS and couldn't find any regressions from applying this patch.

Sorry for the confusion, though this could have been avoided if the debdiffs followed DEP-3 and gave links to the upstream bug and commits.

[Jamie Strandboge (jdstrand)]

ACK for hardy - karmic

[Launchpad Janitor (janitor)]

This bug was fixed in the package php-imap - 5.2.6-0ubuntu6.1

---------------
php-imap (5.2.6-0ubuntu6.1) karmic-security; urgency=low

  * SECURITY UPDATE: unsafe usage of deprecated imap functions (LP: #485973)
    - php_imap.c: apply patch taken from Debian
    - CVE-2008-2829
 -- Devid Antonio Filoni <email address hidden> Wed, 06 Jan 2010 18:58:48 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package php-imap - 5.2.6-0ubuntu5.1

---------------
php-imap (5.2.6-0ubuntu5.1) jaunty-security; urgency=low

  * SECURITY UPDATE: unsafe usage of deprecated imap functions (LP: #485973)
    - php_imap.c: apply patch taken from Debian
    - CVE-2008-2829
 -- Devid Antonio Filoni <email address hidden> Wed, 06 Jan 2010 18:58:48 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package php-imap - 5.2.6-0ubuntu3.1

---------------
php-imap (5.2.6-0ubuntu3.1) intrepid-security; urgency=low

  * SECURITY UPDATE: unsafe usage of deprecated imap functions (LP: #485973)
    - php_imap.c: apply patch taken from Debian
    - CVE-2008-2829
 -- Devid Antonio Filoni <email address hidden> Wed, 06 Jan 2010 18:58:48 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package php-imap - 5.2.3-0ubuntu3.1

---------------
php-imap (5.2.3-0ubuntu3.1) hardy-security; urgency=low

  * SECURITY UPDATE: unsafe usage of deprecated imap functions (LP: #485973)
    - php_imap.c: apply patch taken from Debian
    - CVE-2008-2829
 -- Devid Antonio Filoni <email address hidden> Wed, 06 Jan 2010 18:58:48 +0100

[Jamie Strandboge (jdstrand)]

Per Marc's comment on 2010-01-12, the Dapper debdiff needs to be fixed still. Adding 'patch-needswork' tag and leaving Dapper task as Incomplete.

[Devid Antonio Filoni (d.filoni)]

I don't have time to work on dapper debdiff...