PT-2009-5845 · Php · Php

Published 2009-11-23 · Updated 2024-08-07 · CVE-2009-3559

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 5.3.x before 5.3.1

Description The issue in PHP does not recognize the safe mode include dir directive, which allows context-dependent attackers to have an unknown impact by triggering the failure of PHP scripts that perform include or require operations. This can be demonstrated by a script that attempts to perform a require once on a file in a standard library directory.

Recommendations For PHP versions 5.3.x before 5.3.1, update to version 5.3.1 to resolve the issue.

Fix

Related Identifiers

CVE-2009-3559

Affected Products

Php

References · 13

• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• http://php.net/ChangeLog-5.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3559 · Security Note
• http://openwall.com/lists/oss-security/2009/11/20/2 · Patch
• http://php.net/releases/5_3_1.php · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:302 · Vendor Advisory
• http://openwall.com/lists/oss-security/2009/11/20/5 · Patch
• http://openwall.com/lists/oss-security/2009/11/20/3 · Patch
• http://news.php.net/php.announce/79 · Note
• http://support.apple.com/kb/HT4077 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3559 · Note
• http://bugs.php.net/bug.php?id=50063 · Note
• https://t.me/cvenotify/89582 · Telegram Post