PT-2004-1977 · Php · Php

Published 2004-10-16 · Updated 2017-10-11 · CVE-2004-0959

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.0.2 PHP versions 4.3.8 and prior

Description: The issue allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the $ FILES array to be modified. This may enable an attacker to upload arbitrary files to the remote server.

Recommendations: For PHP versions prior to 5.0.2, update to version 5.0.2 or later to resolve the issue. For PHP versions 4.3.8 and prior, consider upgrading to a newer version to mitigate the risk, as these versions are no longer supported. As a temporary workaround, consider restricting file upload capabilities until a patch is available.

Fix

Related Identifiers

CVE-2004-0959

RHSA-2004:687

Affected Products

Php

References · 14

• http://redhat.com/support/errata/RHSA-2004-687.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0959 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-0959 · Security Note
• https://bugzilla.fedora.us/show_bug.cgi?id=2344 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10961 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-09/0219.html · Note
• http://securitytracker.com/id?1011307 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0959 · Note
• http://marc.info/?l=bugtraq&m=109534848430404&w=2 · Note
• http://secunia.com/advisories/12560 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17392 · Note
• http://bugs.php.net/bug.php?id=28456 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0054.html · Note
• http://viewcvs.php.net/viewcvs.cgi/php-src/NEWS.diff?r1=1.1247.2.724&r2=1.1247.2.726 · Note