PT-2008-3275 · Apache+1 · Apache Http Server+1

David Sveningsson + 3 · Publicado 2008-04-18 · Atualizado 2017-08-08 · CVE-2008-1734

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP Toolkit versions prior to 1.0.1

Description The issue is related to an interpretation conflict in the PHP Toolkit that could allow local users to cause a denial of service and read the contents of PHP scripts. This is achieved by creating a file with a one-letter lowercase alphabetic name, which triggers the interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than as the literal [a-z] regular-expression string. As a result, the launch of the PHP interpreter within the Apache HTTP Server is blocked.

Recommendations For PHP Toolkit versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-1734

Produtos afetados

Apache Http Server

Php Toolkit

Referências · 5

• http://securityfocus.com/bid/28844 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1734 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-200804-19.xml · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41928 · Nota
• http://bugs.gentoo.org/show_bug.cgi?id=209535 · Nota