PT-2004-1642 · Php · Php

Bryce Nichols · Publicado 2004-06-08 · Atualizado 2017-07-11 · CVE-2004-0530

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP package in Slackware versions 8.1 through 9.1

Description The issue allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path because the PHP package, when linked against a static library, includes /tmp in the search path.

Recommendations For Slackware versions 8.1 through 9.1, consider restricting access to the /tmp directory to prevent local users from inserting malicious shared libraries. As a temporary workaround, avoid using static libraries with the PHP package until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-0530

Produtos afetados

Php

Referências · 5

• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.419765 · Aviso do Fabricante
• http://securityfocus.com/bid/10461 · Nota
• http://secunia.com/advisories/11760 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0530 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16310 · Nota