PT-2003-1410 · Php · Php

Stefan Esser

·

Publicado

2003-03-27

·

Atualizado

2018-10-30

·

CVE-2003-0166

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: PHP versions prior to 4.3.2
Description: The issue is related to an integer signedness error in the emalloc() function, which can be exploited by remote attackers to cause a denial of service due to memory consumption. It is also possible for attackers to execute arbitrary code by providing negative arguments to certain functions, including socket recv and socket recvfrom.
Recommendations: For PHP versions prior to 4.3.2, update to version 4.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of functions such as socket recv and socket recvfrom to minimize the risk of exploitation. Avoid using negative arguments in these functions until the issue is resolved.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2003-0166

Produtos afetados

Php