PT-2004-1642 · Php · Php

Bryce Nichols · Published 2004-06-08 · Updated 2017-07-11 · CVE-2004-0530

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP package in Slackware versions 8.1 through 9.1

Description The issue allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path because the PHP package, when linked against a static library, includes /tmp in the search path.

Recommendations For Slackware versions 8.1 through 9.1, consider restricting access to the /tmp directory to prevent local users from inserting malicious shared libraries. As a temporary workaround, avoid using static libraries with the PHP package until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0530

Affected Products

Php

References · 5

• http://slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.419765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0530 · Security Note
• http://securityfocus.com/bid/10461 · Note
• http://secunia.com/advisories/11760 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16310 · Note