PT-2003-2252 · Apache+2 · Apache Http Server+2

Published 2003-12-31 · Updated 2024-08-08 · CVE-2003-1307

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server with mod php module (affected versions not specified)

Description The mod php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors. This can be demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. The PHP developer has disputed this issue, stating that it is not a bug in PHP, but rather the responsibility of Apache to protect the file descriptors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2003-1307

Affected Products

Apache Http Server

Debian

Mod Php

References · 18

• 🔥 http://securityfocus.com/archive/1/348368 · Exploit
• 🔥 https://exploit-db.com/exploits/23482 · Exploit
• 🔥 http://hackerdom.ru/~dimmo/phpexpl.c · Exploit
• 🔥 http://securityfocus.com/bid/9302 · Exploit
• 🔥 http://bugs.php.net/38915 · Exploit
• 🔥 https://exploit-db.com/exploits/23481 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1307 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2003-1307 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1307 · Security Note
• https://security-tracker.debian.org/tracker/source-package/apache2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-1307 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1307 · Note
• http://securityfocus.com/archive/1/449298/100/0/threaded · Note
• https://packages.debian.org/src:apache2 · Note