PT-2008-4268 · Php+1 · Php+1

Published 2008-06-23 · Updated 2019-10-09 · CVE-2008-2829

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 4.x through 5.2.6

Description The issue allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long IMAP request. This request triggers an "rfc822.c legacy routine buffer overflow" error message, related to the rfc822 write address function.

Recommendations For PHP versions 4.x through 5.2.6, consider updating to a version that does not use obsolete API calls to mitigate the risk of a denial of service or arbitrary code execution. As a temporary workaround, consider restricting the length of IMAP requests to prevent the buffer overflow error.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-2829

DTSA-144-1

HPSBUX02431

HPSBUX02465

Affected Products

Hp-Ux

Php

References · 69

• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html · Vendor Advisory
• http://securityfocus.com/bid/29829 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3658 · Security Note
• http://marc.info/?l=bugtraq&m=125631037611762&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3660 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3659 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01465.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2168 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2008:127 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5625 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01451.html · Vendor Advisory