PT-2009-5023 · Php · Php

Maksymilian Arciemowicz · Published 2009-12-01 · Updated 2018-10-30 · CVE-2009-2626

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.1

Description The issue allows context-specific attackers to obtain sensitive information, such as memory contents, and cause a PHP crash. This is achieved by using the ini set function to declare a variable, then using the ini restore function to restore the variable. The zend restore ini entry cb function in zend ini.c is specifically implicated in this issue.

Recommendations For PHP versions prior to 5.3.1, update to a version that contains a fix for this issue, such as PHP 5.3.1 or later, to prevent the potential for sensitive information disclosure and PHP crashes.

Exploit

Fix

Related Identifiers

CVE-2009-2626

DSA-1940-1

Affected Products

Php

References · 11

• 🔥 https://exploit-db.com/exploits/33162 · Exploit
• 🔥 http://securityreason.com/achievement_securityalert/65 · Exploit
• 🔥 https://exploit-db.com/exploits/10296 · Exploit
• 🔥 https://exploit-db.com/exploits/33163 · Exploit
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=540605 · Patch
• http://secunia.com/advisories/37482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2626 · Security Note
• http://securityfocus.com/bid/36009 · Note
• http://debian.org/security/2009/dsa-1940 · Patch, Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2626 · Note
• http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/Zend/zend_ini.c?r1=272370&r2=284156 · Note