PT-2010-2846 · Php · Php

Grzegorz Stachowiak · Published 2010-03-26 · Updated 2018-10-30 · CVE-2010-1130

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.13 PHP versions prior to 5.3.1

Description The issue allows context-dependent attackers to bypass open basedir and safe mode restrictions. This is achieved by providing an argument to the session save path function that contains multiple ; characters in conjunction with a .. (dot dot), which is not properly interpreted by the session.c in the session extension.

Recommendations For PHP versions prior to 5.2.13, update to version 5.2.13 or later to resolve the issue. For PHP versions prior to 5.3.1, update to version 5.3.1 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-1130

Affected Products

Php

References · 14

• 🔥 http://securityreason.com/securityalert/7008 · Exploit
• 🔥 https://exploit-db.com/exploits/33625 · Exploit
• http://secunia.com/advisories/38708 · Vendor Advisory
• http://php.net/releases/5_2_13.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-1130 · Security Note
• http://vupen.com/english/advisories/2010/0479 · Vendor Advisory
• http://securityreason.com/achievement_securityalert/82 · Note
• http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/session/session.c?r1=293036&r2=294272 · Note
• http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/session/session.c?view=log · Note
• http://securitytracker.com/id?1023661 · Note
• http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/session/session.c?view=log · Note
• http://php.net/ChangeLog-5.php · Note
• http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/session/session.c?r1=293036&r2=294272 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1130 · Note