PT-2008-6678 · Php+1 · Php+1

Cxib8O3 + 1 · Published 2008-12-17 · Updated 2018-10-11 · CVE-2008-5625

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.7

Description The issue allows context-dependent attackers to write to arbitrary files. This is possible because PHP does not enforce the error log safe mode restrictions when safe mode is enabled through a php admin flag setting in httpd.conf. An attacker can exploit this by placing a "php value error log" entry in a .htaccess file.

Recommendations For PHP versions prior to 5.2.7, update to version 5.2.7 or later to resolve the issue. As a temporary workaround, consider disabling the use of .htaccess files to minimize the risk of exploitation. Restrict access to the error log setting in php admin flag to prevent unauthorized modifications.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-5625

HPSBUX02431

HPSBUX02465

Affected Products

Hp-Ux

Php

References · 52

• 🔥 http://securityreason.com/achievement_securityalert/57 · Exploit
• 🔥 https://exploit-db.com/exploits/7171 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3658 · Security Note
• http://marc.info/?l=bugtraq&m=125631037611762&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3660 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2168 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:045 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2364 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2829 · Security Note
• https://bdu.fstec.ru/vul/2015-09343 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-5625 · Security Note