PT-2008-3275 · Apache+1 · Apache Http Server+1

David Sveningsson + 3 · Published 2008-04-18 · Updated 2017-08-08 · CVE-2008-1734

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP Toolkit versions prior to 1.0.1

Description The issue is related to an interpretation conflict in the PHP Toolkit that could allow local users to cause a denial of service and read the contents of PHP scripts. This is achieved by creating a file with a one-letter lowercase alphabetic name, which triggers the interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than as the literal [a-z] regular-expression string. As a result, the launch of the PHP interpreter within the Apache HTTP Server is blocked.

Recommendations For PHP Toolkit versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-1734

Affected Products

Apache Http Server

Php Toolkit

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-1734 · Security Note
• http://security.gentoo.org/glsa/glsa-200804-19.xml · Vendor Advisory
• http://securityfocus.com/bid/28844 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41928 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=209535 · Note