PT-2009-5845 · Php · Php

CVE-2009-3559 · Publicado 2009-11-23 · Atualizado 2024-08-07

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 5.3.x before 5.3.1

Description The issue in PHP does not recognize the safe mode include dir directive, which allows context-dependent attackers to have an unknown impact by triggering the failure of PHP scripts that perform include or require operations. This can be demonstrated by a script that attempts to perform a require once on a file in a standard library directory.

Recommendations For PHP versions 5.3.x before 5.3.1, update to version 5.3.1 to resolve the issue.

Correção

Identificadores relacionados

CVE-2009-3559

Produtos afetados

Php

Referências · 13

• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Aviso do Fabricante
• http://php.net/ChangeLog-5.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3559 · Nota de Segurança
• http://news.php.net/php.announce/79 · Nota
• http://openwall.com/lists/oss-security/2009/11/20/2 · Correção
• http://support.apple.com/kb/HT4077 · Nota
• http://php.net/releases/5_3_1.php · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2009:302 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3559 · Nota
• http://bugs.php.net/bug.php?id=50063 · Nota
• http://openwall.com/lists/oss-security/2009/11/20/5 · Correção
• https://t.me/cvenotify/89582 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2009/11/20/3 · Correção