PT-2002-2505 · Php · Php

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1783

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 4.2.1 through 4.2.3

Description The issue allows remote attackers to modify HTTP headers for outgoing requests by injecting CRLF sequences into arguments passed to the (1) fopen or (2) file functions when allow url fopen is enabled.

Recommendations For PHP versions 4.2.1 through 4.2.3, consider disabling the allow url fopen option as a temporary workaround to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-1783

Produtos afetados

Php

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2002-1783 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2002-09/0132.html · Correção
• http://securityfocus.com/bid/5681 · Correção
• http://debian.org/security/2002/dsa-168 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10080 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2002-09/0086.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1783 · Nota