PT-2003-1410 · Php · Php
Stefan Esser
·
Published
2003-03-27
·
Updated
2018-10-30
·
CVE-2003-0166
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
PHP versions prior to 4.3.2
Description:
The issue is related to an integer signedness error in the emalloc() function, which can be exploited by remote attackers to cause a denial of service due to memory consumption. It is also possible for attackers to execute arbitrary code by providing negative arguments to certain functions, including
socket recv and socket recvfrom.Recommendations:
For PHP versions prior to 4.3.2, update to version 4.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of functions such as
socket recv and socket recvfrom to minimize the risk of exploitation. Avoid using negative arguments in these functions until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Php