PT-2014-2037 · Php · Php

Kurt Seifried · Publicado 2014-02-15 · Atualizado 2014-02-18 · CVE-2012-1171

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.x

Description The issue allows remote attackers to bypass the open basedir protection mechanism and read arbitrary files. This is achieved through vectors involving a stream close method call during the use of a custom stream wrapper. The exploitation of this issue may allow a remote attacker to disclose protected information by reading arbitrary files.

Recommendations For PHP version 5.x, consider disabling custom stream wrappers until a patch is available to prevent the exploitation of this issue. Restrict access to sensitive files and directories to minimize the risk of arbitrary file reading. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2022-02602

CVE-2012-1171

Produtos afetados

Php

Referências · 7

• https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-read.phpt · Aviso do Fabricante
• https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-write.phpt · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=802591 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1171 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1171 · Nota
• https://bdu.fstec.ru/vul/2022-02602 · Nota de Segurança
• https://bugs.php.net/bug.php?id=61367 · Nota