PT-2005-3887 · Php · Php

Martin Pitt + 1 · Published 2005-09-26 · Updated 2018-10-03 · CVE-2005-3054

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 4.4.0

Description The issue arises from improper restriction of access to other directories when the open basedir directive includes a trailing slash. This allows PHP scripts in one directory to access files in other directories whose names are substrings of the original directory.

Recommendations For PHP version 4.4.0, consider removing the trailing slash from the open basedir directive to prevent unauthorized access to other directories.

Fix

Related Identifiers

CVE-2005-3054

Affected Products

Php

References · 19

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323585 · Vendor Advisory
• http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:213 · Vendor Advisory
• https://usn.ubuntu.com/207-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3054 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200511-08.xml · Vendor Advisory
• http://vupen.com/english/advisories/2005/2254 · Note
• http://vupen.com/english/advisories/2005/1862 · Note
• http://secunia.com/advisories/17510 · Note
• http://frsirt.com/english/advisories/2005/1862 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3054 · Note
• http://secunia.com/advisories/17371 · Note
• http://securityfocus.com/bid/14957 · Note
• http://frontal2.mandriva.com/security/advisories?name=MDKSA-2005:213 · Note
• http://frsirt.com/english/advisories/2005/2254 · Note