PT-2002-2505 · Php · Php

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1783

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 4.2.1 through 4.2.3

Description The issue allows remote attackers to modify HTTP headers for outgoing requests by injecting CRLF sequences into arguments passed to the (1) fopen or (2) file functions when allow url fopen is enabled.

Recommendations For PHP versions 4.2.1 through 4.2.3, consider disabling the allow url fopen option as a temporary workaround to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1783

Affected Products

Php

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2002-1783 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2002-09/0132.html · Patch
• http://securityfocus.com/bid/5681 · Patch
• http://debian.org/security/2002/dsa-168 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2002-09/0086.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10080 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1783 · Note