9 ms·
PCRE Heap Overflow in Regex Processing Lets Users Execute Arbitrary Code
- muraiki 11y agoI'm not that familiar with PCRE, but I think that this engine is used in a variety of programming languages -- but not Perl's, as it's used to provide Perl-compatible regex. PHP's Manual for PCRE links to pcre.org, so it seems that at least PHP is vulnerable. http://php.net/manual/en/intro.pcre.php http://php.net/manual/en/intro.pcre.php Edit: Here's a copy of the actual CVE, which demonstrates the vulnerability using PHP: http://www.openwall.com/lists/oss-security/2015/06/01/6 http://www.openwall.com/lists/oss-security/2015/06/01/6 The CVE mentions that PCRE is used in Flash, Apache, and Nginx. Edit2: Could a mod change the article url to the openwall CVE? It seems that securitytracker.com is not the most responsive website. Sorry, I should have linked to the CVE directly.
- bpoyner 11y agoFor yum based systems can you find all packages installed requiring PCRE and all packages in the yum repos which require PCRE: repoquery --whatrequires pcre --installed repoquery --whatrequires pcre
- Ysx 11y agoThe apt equivalent seems to be `apt-cache rdepends libpcre3`
- y0ghur7_xxx 11y agoHere the text is formatted better: https://bugs.exim.org/show_bug.cgi?id=1636 https://bugs.exim.org/show_bug.cgi?id=1636
- berntb 11y agoPerl do allow you to use alternative Regexp engines. There is a PCRE too. It doesn't seem to be supported anymore (it could be useful for internal testing, of course). http://search.cpan.org/~avar/re-engine-PCRE-0.17/lib/re/engine/PCRE.pm http://search.cpan.org/~avar/re-engine-PCRE-0.17/lib/re/engi... (I'm Hellbanned, too easily trolled when I have allergy troubles. :-) This in itself is probably not an offensive comment.)
- trebor 11y agoAnyone compiling regex strings in PHP from user input should take care to use preg_quote(): http://php.net/manual/en/function.preg-quote.php http://php.net/manual/en/function.preg-quote.php Otherwise, you're in risky business trusting what a user could send you.
- 0x0 11y agoEspecially since you could otherwise inject "/e" which turns the whole thing into an eval() !
- Sophistifunk 11y agoSERIOUSLY!? eval() from regexes!? Jebus... Just burn it all down, we're screwed.
- developer1 11y agoFrom the documentation for regex modifiers: "DEPRECATED as of PHP 5.5.0 and REMOVED as of PHP 7.0.0". Not for much longer.
- jdangu 11y agoFlash fell for a PCRE-related exploit in March. http://googleprojectzero.blogspot.com/2015/02/exploitingscve-2015-0318sinsflash.html http://googleprojectzero.blogspot.com/2015/02/exploitingscve...
- samch 11y agoI build nginx with PCRE, and I'm curious if this vulnerability would impact nginx in some way. My hope is that since nginx is using it internally and not accepting randomly-supplied regex strings, then there might be minimal impact. Can anybody with more knowledge of nginx + PCRE comment on this?
- warbiscuit 11y agoIf I'm reading this right, the exploit is in the regex compilation stage, not the data matching stage; therefore remote exploitation would require the server setup to compile attacker-provided regexps, not just setup to run attacker data through an admin-configured regexp? If that's the case, a typical nginx/apache config shouldn't be remotely vulnerable, right? Though I could see some shared hosting scenarios having some issues.
- TheLoneWolfling 11y agoSimple searches could be an issue, however.
- pg_is_a_butt 11y agosimple searches would be escaped... in PHP's implementation of PCRE, you'd use the preg_quote function... you should never execute raw user data as a regex.
- duaneb 11y agoNot everyone quotes the things they put into regular expressions. Before that would have resulted in incorrect code, but now it's a security vulnerability.
- _lce0 11y agowow, I was expecting an odd looking, weird, larger regex, but look at this.. /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/ is that `WGXCREDITS` the command to execute?
- thefreeman 11y agoDefinitely not. It is a HEAP overflow exploit. It allows you to write arbitrary data outside the bounds of the allocated memory in the heap. The string is likely only important due to its length. Using an alternate 10 character string triggers the same error: ~ $ php -a Interactive shell php > preg_match("/^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/","ADLAB",$arr); *** Error in `php': free(): invalid next size (normal): 0x0000000002ff7a10 *** Aborted ~ $ php -a Interactive shell php > preg_match("/^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>AAAAAAAAAA)/","ADLAB",$arr); *** Error in `php': free(): invalid next size (normal): 0x00000000020e5a10 *** Aborted
- nly 11y agoWhat does that regex even match?
- ackalker 11y agoIt is quite possible that the regex doesn't match anything useful. From the looks of it, I would say it was generated using a fuzzing tool, in much the same way as what lead to the discovery of the Shellshock vulnerability.
- deleted 11y ago[deleted]
- timboslice 11y agoWhat does this mean to someone with a public facing website that uses PHP w/ Apache or Nginx?
- mahouse 11y agoMy guess is that nothing unless you let the user input REs. (Or use REs that can be modified by user input)
- timboslice 11y agoThank you :)
- alanstorm 11y agoIt means if you have a PHP script or application (Wordpress, Drupal, etc) on your server, and there's code in the script or application that uses one of the `pcre_` functions, and that the regular expression passed to that `pcre` function uses user input to create a regular expression, then an attacker can theoretically run any unix command on the server. This means your user information (including any passwords in text files) is vulnerable, and it puts the attacker in a great position to gain full access to the server. Until PCRE or PHP release a patch for this, you remain vulnerable. You'd want to defend against this at the web server level -- think `MOD_SECURITY` rules that scan requests, look for known "bad" regular expressions, and then stop that request from reaching the PHP application. If you have a good hosting company hopefully they're already doing this for you.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- hinkley 11y agoNow you have three problems.
- jakozaur 11y agoIf you take regex as user input, you should use RE2: https://github.com/google/re2 https://github.com/google/re2 Even without this vulnerability, some regexes can be painfully slow.
- tobinfricke 11y agoA regular expression processing library seems like a great candidate for something that could be implemented in a "safe" language - Haskell, OCAML, (Rust?), etc.
- chbrown 11y agoI guess this means that regular expressions are Turing complete, at least until a patch arrives?