PT-2008-2967 · Php · Php

Maksymilian Arciemowicz · Publicado 2008-03-27 · Atualizado 2018-10-11 · CVE-2008-1384

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.6

Description The issue is related to an integer overflow that allows context-dependent attackers to cause a denial of service and possibly have other unspecified impacts. This is achieved via a printf format parameter with a large width specifier. The problem is associated with the php sprintf appendstring function in formatted print.c and probably other functions for formatted strings, also known as *printf functions.

Recommendations For PHP versions prior to 5.2.6, update to a version 5.2.6 or later to resolve the issue.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2008-1384

DSA-1572-1

DTSA-135-1

Produtos afetados

Php

Referências · 25

• 🔥 http://securityreason.com/achievement_securityalert/52 · Exploit
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178 · Nota
• http://secunia.com/advisories/32746 · Nota
• http://cvs.php.net/viewvc.cgi/php-src/NEWS?revision=1.2027.2.547.2.1120&view=markup · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2009:022 · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1572 · Aviso do Fabricante
• http://securityfocus.com/archive/1/489962/100/0/threaded · Nota
• http://xforce.iss.net/xforce/xfdb/41386 · Nota
• http://securityfocus.com/archive/1/492535/100/0/threaded · Nota
• http://secunia.com/advisories/30967 · Nota
• http://secunia.com/advisories/30411 · Nota
• http://secunia.com/advisories/30345 · Nota
• http://securityfocus.com/bid/28392 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41386 · Nota
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0176 · Nota