PT-2008-6677 · Php+1 · Php+1

Published 2008-12-17 · Updated 2018-10-11 · CVE-2008-5624

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.7

Description The issue allows context-dependent attackers to bypass safe mode restrictions. This is due to the improper initialization of the page uid and page gid global variables for use by the SAPI php getuid function. Attackers can exploit this by setting variables intended to be restricted to root, such as setting /etc for the error log variable.

Recommendations For PHP versions prior to 5.2.7, update to version 5.2.7 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-5624

DSA-1789-1

DTSA-188-1

HPSBUX02431

HPSBUX02465

Affected Products

Hp-Ux

Php

References · 54

• 🔥 http://securityreason.com/achievement_securityalert/59 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3658 · Security Note
• http://marc.info/?l=bugtraq&m=125631037611762&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3660 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3659 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2168 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5625 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:045 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2665 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5624 · Security Note