php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #65698 certificates validity parsing does not work past 2050
Submitted: 2013-09-18 14:51 UTC Modified: 2014-06-08 21:21 UTC
Votes:3
Avg. Score:4.7 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:0 (0.0%)
From: tranzig at gmail dot com Assigned: stas
Status: Closed Package: OpenSSL related
PHP Version: master-Git-2013-09-18 (Git) OS:
Private report: No CVE-ID:
 [2013-09-18 14:51 UTC] tranzig at gmail dot com
Description:
------------
In asn1_time_to_time_t [ext/openssl/openssl.c], the Y2K bug makes a cameo 
appearance:
[...]
*thestr = '\0';
thestr -= 2;
thetime.tm_year = atoi(thestr);

if (thetime.tm_year < 68) {
  thetime.tm_year += 100;
}

This piece of code is the part of a backwards UTCTime parser. It moves 2 
positions to the left, and converts those two characters to an int.

However, certs with a validity past 2050 contain GeneralizedTime formatted 
timestamps allowing 4 characters in the year field instead of the UTCTime this 
function parses (badly). [rfc5280, 4.1.2.5]

Test script:
---------------
An example script that demonstrates the problem with a cert expiring 2101:
http://pastebin.com/Yij0q1qn

Expected result:
----------------
Actual time string of validity:  21010828070405Z
parsed with strtotime:           4154655845 [2101-08-28]
parsed with asn1_time_to_time_t: 4154655845  [2101-08-28]

Actual result:
--------------
Actual time string of validity:  21010828070405Z
parsed with strtotime:           4154655845 [2101-08-28]
parsed with asn1_time_to_time_t: 998982245  [2001-08-28]

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2014-03-21 15:34 UTC] oroszisam at gmail dot com
With the fix for CVE-2013-6420, this bug became even more visible.

Now, instead of silently returning an incorrect timestamp, a PHP 
warning is thrown for all certificates where the notBefore or 
notAfter field is in the GeneralizedTime format, stating that it is an 
"illegal ASN1 data type for timestamp", which is an obviously incorrect
statement.
 [2014-06-08 21:21 UTC] stas@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: stas
 [2014-06-08 21:21 UTC] stas@php.net
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Tue Aug 29 15:01:52 2017 UTC