4 ms·
I'm not that familiar with PCRE, but I think that this engine is used in a variety of programming languages -- but not Perl's, as it's used to provide Perl-comp
by muraiki 11y ago
I'm not that familiar with PCRE, but I think that this engine is used in a variety of programming languages -- but not Perl's, as it's used to provide Perl-compatible regex. PHP's Manual for PCRE links to pcre.org, so it seems that at least PHP is vulnerable.
http://php.net/manual/en/intro.pcre.php http://php.net/manual/en/intro.pcre.php
Edit: Here's a copy of the actual CVE, which demonstrates the vulnerability using PHP: http://www.openwall.com/lists/oss-security/2015/06/01/6 http://www.openwall.com/lists/oss-security/2015/06/01/6
The CVE mentions that PCRE is used in Flash, Apache, and Nginx.
Edit2: Could a mod change the article url to the openwall CVE? It seems that securitytracker.com is not the most responsive website. Sorry, I should have linked to the CVE directly.
- bpoyner 11y agoFor yum based systems can you find all packages installed requiring PCRE and all packages in the yum repos which require PCRE: repoquery --whatrequires pcre --installed repoquery --whatrequires pcre
- Ysx 11y agoThe apt equivalent seems to be `apt-cache rdepends libpcre3`
- y0ghur7_xxx 11y agoHere the text is formatted better: https://bugs.exim.org/show_bug.cgi?id=1636 https://bugs.exim.org/show_bug.cgi?id=1636
- berntb 11y agoPerl do allow you to use alternative Regexp engines. There is a PCRE too. It doesn't seem to be supported anymore (it could be useful for internal testing, of course). http://search.cpan.org/~avar/re-engine-PCRE-0.17/lib/re/engine/PCRE.pm http://search.cpan.org/~avar/re-engine-PCRE-0.17/lib/re/engi... (I'm Hellbanned, too easily trolled when I have allergy troubles. :-) This in itself is probably not an offensive comment.)
- trebor 11y agoAnyone compiling regex strings in PHP from user input should take care to use preg_quote(): http://php.net/manual/en/function.preg-quote.php http://php.net/manual/en/function.preg-quote.php Otherwise, you're in risky business trusting what a user could send you.
- 0x0 11y agoEspecially since you could otherwise inject "/e" which turns the whole thing into an eval() !
- Sophistifunk 11y agoSERIOUSLY!? eval() from regexes!? Jebus... Just burn it all down, we're screwed.
- developer1 11y agoFrom the documentation for regex modifiers: "DEPRECATED as of PHP 5.5.0 and REMOVED as of PHP 7.0.0". Not for much longer.
- jdangu 11y agoFlash fell for a PCRE-related exploit in March. http://googleprojectzero.blogspot.com/2015/02/exploitingscve-2015-0318sinsflash.html http://googleprojectzero.blogspot.com/2015/02/exploitingscve...