PT-2008-5565 · Phpcollab · Phpcollab

Christian Hoffmann · Published 2008-12-23 · Updated 2017-08-08 · CVE-2008-4304

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: phpCollab versions 2.5 rc3 and earlier

Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSL CLIENT CERT environment variable. In some environments, SSL CLIENT CERT always has a base64-encoded string value, which may impose constraints on injection for typical shells.

Recommendations: For phpCollab versions 2.5 rc3 and earlier, consider restricting access to the general/login.php file until a fix is available. As a temporary workaround, avoid using the SSL CLIENT CERT environment variable in sensitive operations.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2008-4304

Affected Products

Phpcollab

References · 7

• http://security.gentoo.org/glsa/glsa-200812-20.xml · Vendor Advisory
• http://secunia.com/advisories/33258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4304 · Security Note
• http://securityfocus.com/bid/32964 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47522 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4304 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=235052 · Note