PT-2005-3887 · Php · Php

Martin Pitt + 1 · Publicado 2005-09-26 · Atualizado 2018-10-03 · CVE-2005-3054

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 4.4.0

Description The issue arises from improper restriction of access to other directories when the open basedir directive includes a trailing slash. This allows PHP scripts in one directory to access files in other directories whose names are substrings of the original directory.

Recommendations For PHP version 4.4.0, consider removing the trailing slash from the open basedir directive to prevent unauthorized access to other directories.

Correção

Identificadores relacionados

CVE-2005-3054

Produtos afetados

Php

Referências · 19

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323585 · Aviso do Fabricante
• http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/2254 · Nota
• http://vupen.com/english/advisories/2005/1862 · Nota
• http://secunia.com/advisories/17510 · Nota
• http://frsirt.com/english/advisories/2005/1862 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3054 · Nota
• http://secunia.com/advisories/17371 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2005:213 · Aviso do Fabricante
• http://securityfocus.com/bid/14957 · Nota
• http://frontal2.mandriva.com/security/advisories?name=MDKSA-2005:213 · Nota
• http://frsirt.com/english/advisories/2005/2254 · Nota
• https://usn.ubuntu.com/207-1 · Aviso do Fabricante
• http://secunia.com/advisories/17229 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3054 · Nota de Segurança