PT-2009-5844 · Php · Php

Grzegorz Stachowiak · Published 2009-11-23 · Updated 2018-10-30 · CVE-2009-3558

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.12 PHP versions 5.3.x prior to 5.3.1

Description The issue allows context-dependent attackers to bypass open basedir restrictions and create FIFO files via the pathname and mode arguments in the posix mkfifo function. This can be demonstrated by creating a .htaccess file.

Recommendations For PHP versions prior to 5.2.12, update to version 5.2.12 or later. For PHP versions 5.3.x prior to 5.3.1, update to version 5.3.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3558

Affected Products

Php

References · 21

• 🔥 http://securityreason.com/securityalert/6600 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3558 · Security Note
• http://svn.php.net/viewvc?view=revision&revision=288943 · Patch
• http://openwall.com/lists/oss-security/2009/11/20/5 · Patch
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• http://secunia.com/advisories/37412 · Vendor Advisory
• http://openwall.com/lists/oss-security/2009/11/20/2 · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2009:302 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:303 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:285 · Vendor Advisory
• http://openwall.com/lists/oss-security/2009/11/20/3 · Patch
• http://vupen.com/english/advisories/2009/3593 · Note
• http://php.net/ChangeLog-5.php · Note
• http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/posix/posix.c?view=log · Note
• http://news.php.net/php.announce/79 · Note