PT-2003-1149 · Php · Php

Published 2003-01-17 · Updated 2018-05-03 · CVE-2002-1396

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 4.1.2 through 4.2.3 PHP version 4.3.0 is not affected, but since the range is specified as after 4.1.2 and before 4.3.0, we can simplify it to: PHP versions 4.1.3 through 4.2.3

Description The issue is related to a heap-based buffer overflow in the wordwrap function in PHP, which may allow attackers to cause a denial of service or execute arbitrary code. A remote attacker could overflow a buffer and execute arbitrary code on the server or cause the Web server to crash by sending a specially-crafted request to an affected Web server.

Recommendations For PHP versions 4.1.3 through 4.2.3, update to a version after 4.2.3 to resolve the issue. As a temporary workaround, consider disabling the wordwrap() function until a patch is available.

Fix

Related Identifiers

CVE-2002-1396

Affected Products

Php

References · 13

• http://novell.com/linux/security/advisories/2003_009_mod_php4.html · Vendor Advisory
• http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0003.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-017.html · Vendor Advisory
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:019 · Vendor Advisory
• http://bugs.php.net/bug.php?id=20927 · Vendor Advisory
• http://securityfocus.com/bid/6488 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1396 · Security Note
• http://securityfocus.com/advisories/4862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1396 · Security Note
• http://marc.info/?l=bugtraq&m=104102689503192&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1396 · Note
• http://xforce.iss.net/xforce/xfdb/10944 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10944 · Note