PT-2002-1991 · Php+1 · Php+1

Published 2002-09-24 · Updated 2024-02-13 · CVE-2002-0985

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP versions 4.x through 4.2.2

Description: The issue allows attackers to bypass safe mode restrictions and modify command line arguments to the MTA, such as sendmail, in the 5th argument to the mail() function, potentially altering MTA behavior and executing commands.

Recommendations: For PHP versions 4.x through 4.2.2, consider disabling the mail() function until a patch is available to prevent potential command execution. Restrict access to the mail function to minimize the risk of exploitation. Avoid using the 5th argument in the mail() function until the issue is resolved.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2002-0985

DSA-168

Affected Products

Php

Sendmail

References · 18

• http://redhat.com/support/errata/RHSA-2002-213.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-214.html · Vendor Advisory
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0985 · Security Note
• http://novell.com/linux/security/advisories/2002_036_modphp4.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-248.html · Vendor Advisory
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:082 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-159.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-244.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-243.html · Vendor Advisory
• http://debian.org/security/2002/dsa-168 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=103011916928204&w=2 · Note
• https://t.me/cvenotify/71278 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0985 · Note