PT-2009-2537 · Php · Php

Published 2009-08-25 · Updated 2018-10-30 · CVE-2008-7068

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 4.x through 5.2.6

Description The issue allows context-dependent attackers to cause a denial of service, specifically file truncation, under certain circumstances. This can happen when an attacker can modify or add database entries but lacks the necessary permissions to directly truncate the file. The attack is facilitated through a key containing the NULL byte, which is processed by the dba replace function.

Recommendations For PHP versions 4.x through 5.2.6, consider restricting access to the dba replace function to prevent potential exploitation, especially in scenarios where database entry modification is possible but file truncation permissions are restricted. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-7068

DTSA-188-1

Affected Products

Php

References · 9

• 🔥 http://securityreason.com/achievement_securityalert/58 · Exploit
• http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313&r2=1.2027.2.547.2.1314& · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-7068 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7068 · Note
• http://securityfocus.com/archive/1/498982/100/0/threaded · Note
• http://securityfocus.com/archive/1/498981/100/0/threaded · Note
• http://securityfocus.com/archive/1/498746/100/0/threaded · Note
• http://osvdb.org/52206 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47316 · Note