PT-2002-1739 · Php · Php

Published 2002-07-23 · Updated 2016-10-18 · CVE-2002-0717

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 4.2.0 through 4.2.1

Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form. This is due to the PHP interpreter incorrectly parsing MIME headers when HTTP POST commands are received, generating an error condition that is not properly handled. As a result, an attacker may cause the web server to crash and possibly execute supplied code.

Recommendations For PHP version 4.2.0, update to a version that properly handles error conditions generated by malformed POST requests. For PHP version 4.2.1, update to a version that correctly parses MIME headers in HTTP POST commands to prevent improper memory freeing.

Fix

Related Identifiers

CVE-2002-0717

Affected Products

Php

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0717 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2002-0717 · Security Note
• http://marc.info/?l=bugtraq&m=102734516023281&w=2 · Note
• http://iss.net/security_center/static/9635.php · Note
• http://cert.org/advisories/CA-2002-21.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0717 · Note
• http://securityfocus.com/bid/5278 · Note
• http://marc.info/?l=bugtraq&m=102734515923277&w=2 · Note
• http://kb.cert.org/vuls/id/929115 · Note