PT-2009-5844 · Php · Php

Grzegorz Stachowiak · Publicado 2009-11-23 · Atualizado 2018-10-30 · CVE-2009-3558

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.12 PHP versions 5.3.x prior to 5.3.1

Description The issue allows context-dependent attackers to bypass open basedir restrictions and create FIFO files via the pathname and mode arguments in the posix mkfifo function. This can be demonstrated by creating a .htaccess file.

Recommendations For PHP versions prior to 5.2.12, update to version 5.2.12 or later. For PHP versions 5.3.x prior to 5.3.1, update to version 5.3.1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-3558

Produtos afetados

Php

Referências · 21

• 🔥 http://securityreason.com/securityalert/6600 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3558 · Nota de Segurança
• http://vupen.com/english/advisories/2009/3593 · Nota
• http://php.net/ChangeLog-5.php · Nota
• http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/posix/posix.c?view=log · Nota
• http://news.php.net/php.announce/79 · Nota
• http://svn.php.net/viewvc?view=revision&revision=288943 · Correção
• http://openwall.com/lists/oss-security/2009/11/20/5 · Correção
• http://php.net/releases/5_2_12.php · Nota
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Aviso do Fabricante
• http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/posix/posix.c?view=log · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3558 · Nota
• http://secunia.com/advisories/37412 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2009/11/20/2 · Correção
• http://support.apple.com/kb/HT4077 · Nota