PT-2010-2845 · Php · Php

Grzegorz Stachowiak · Publicado 2010-03-26 · Atualizado 2010-08-31 · CVE-2010-1129

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.13

Description The issue arises from the safe mode implementation not properly handling directory pathnames without a trailing slash, allowing attackers to bypass access restrictions through vectors related to the tempnam function.

Recommendations For versions prior to 5.2.13, update to version 5.2.13 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-1129

Produtos afetados

Php

Referências · 13

• http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1129 · Nota
• http://securitytracker.com/id?1023661 · Nota
• http://securityfocus.com/bid/38431 · Nota
• http://support.apple.com/kb/HT4312 · Nota
• http://secunia.com/advisories/38708 · Aviso do Fabricante
• http://php.net/ChangeLog-5.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1129 · Nota de Segurança
• http://vupen.com/english/advisories/2010/1796 · Nota
• http://php.net/releases/5_2_13.php · Correção
• http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html · Aviso do Fabricante
• http://secunia.com/advisories/40551 · Nota
• http://vupen.com/english/advisories/2010/0479 · Aviso do Fabricante