scottmac Thu, 26 Jan 2012 05:15:57 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=322785
Log:
MFH r322485
Fix possible attack in SSL sockets with SSL 3.0 / TLS 1.0.
CVE-2011-3389
Changed paths:
U php/php-src/branches/PHP_5_4/NEWS
U php/php-src/branches/PHP_5_4/ext/ftp/ftp.c
U php/php-src/branches/PHP_5_4/ext/openssl/xp_ssl.c
Modified: php/php-src/branches/PHP_5_4/NEWS
===================================================================
--- php/php-src/branches/PHP_5_4/NEWS 2012-01-26 04:16:32 UTC (rev 322784)
+++ php/php-src/branches/PHP_5_4/NEWS 2012-01-26 05:15:57 UTC (rev 322785)
@@ -1,6 +1,8 @@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? Jan 2012, PHP 5.4.0
+?? Jan 2012, PHP 5.4.0 RC 7
+- Fix possible attack in SSL sockets with SSL 3.0 / TLS 1.0.
+ CVE-2011-3389. (Scott)
19 Jan 2012, PHP 5.4.0 RC6
Modified: php/php-src/branches/PHP_5_4/ext/ftp/ftp.c
===================================================================
--- php/php-src/branches/PHP_5_4/ext/ftp/ftp.c 2012-01-26 04:16:32 UTC (rev
322784)
+++ php/php-src/branches/PHP_5_4/ext/ftp/ftp.c 2012-01-26 05:15:57 UTC (rev
322785)
@@ -243,6 +243,7 @@
{
#if HAVE_OPENSSL_EXT
SSL_CTX *ctx = NULL;
+ long ssl_ctx_options = SSL_OP_ALL;
#endif
if (ftp == NULL) {
return 0;
@@ -279,7 +280,10 @@
return 0;
}
- SSL_CTX_set_options(ctx, SSL_OP_ALL);
+#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
+ ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+#endif
+ SSL_CTX_set_options(ctx, ssl_ctx_options);
ftp->ssl_handle = SSL_new(ctx);
if (ftp->ssl_handle == NULL) {
@@ -1495,6 +1499,7 @@
#if HAVE_OPENSSL_EXT
SSL_CTX *ctx;
+ long ssl_ctx_options = SSL_OP_ALL;
#endif
if (data->fd != -1) {
@@ -1521,7 +1526,10 @@
return 0;
}
- SSL_CTX_set_options(ctx, SSL_OP_ALL);
+#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
+ ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+#endif
+ SSL_CTX_set_options(ctx, ssl_ctx_options);
data->ssl_handle = SSL_new(ctx);
if (data->ssl_handle == NULL) {
Modified: php/php-src/branches/PHP_5_4/ext/openssl/xp_ssl.c
===================================================================
--- php/php-src/branches/PHP_5_4/ext/openssl/xp_ssl.c 2012-01-26 04:16:32 UTC
(rev 322784)
+++ php/php-src/branches/PHP_5_4/ext/openssl/xp_ssl.c 2012-01-26 05:15:57 UTC
(rev 322785)
@@ -310,6 +310,7 @@
TSRMLS_DC)
{
SSL_METHOD *method;
+ long ssl_ctx_options = SSL_OP_ALL;
if (sslsock->ssl_handle) {
if (sslsock->s.is_blocked) {
@@ -377,7 +378,10 @@
return -1;
}
- SSL_CTX_set_options(sslsock->ctx, SSL_OP_ALL);
+#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
+ ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+#endif
+ SSL_CTX_set_options(sslsock->ctx, ssl_ctx_options);
#if OPENSSL_VERSION_NUMBER >= 0x0090806fL
{
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
