PT-2009-5843 · Php+1 · Php+1

Grzegorz Stachowiak · Published 2009-11-23 · Updated 2018-10-30 · CVE-2009-3557

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.2.11 and earlier PHP versions 5.3.x before 5.3.1

Description The issue allows context-dependent attackers to bypass safe mode restrictions and create files in group-writable or world-writable directories via the dir and prefix arguments in the tempnam function.

Recommendations For PHP versions 5.2.11 and earlier, update to version 5.2.12 or later. For PHP versions 5.3.x before 5.3.1, update to version 5.3.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3557

HPSBUX02543

Affected Products

Hp-Ux

Php

References · 38

• 🔥 http://securityreason.com/securityalert/6601 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4018 · Security Note
• http://openwall.com/lists/oss-security/2009/11/20/5 · Patch
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4017 · Security Note
• http://secunia.com/advisories/37412 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:303 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3557 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3293 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3292 · Security Note
• http://openwall.com/lists/oss-security/2009/11/20/3 · Patch
• http://php.net/ChangeLog-5.php · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3291 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3557 · Security Note
• http://marc.info/?l=bugtraq&m=127680701405735&w=2 · Vendor Advisory