PT-2011-1234 · Php · Php

Published 2011-01-18 · Updated 2018-10-30 · CVE-2010-4699

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.4

Description The issue is related to the iconv mime decode headers function in the Iconv extension, which does not properly handle unrecognized encodings. This can be exploited by remote attackers to trigger an incomplete output array, potentially bypassing spam detection or having other unspecified impacts. The attack can be carried out via a crafted Subject header in an e-mail message.

Recommendations For versions prior to 5.3.4, update to version 5.3.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the iconv mime decode headers function until a patch is available. Avoid using unrecognized encodings in the Subject header of e-mail messages to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2022-02605

CVE-2010-4699

Affected Products

Php

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2010-4699 · Security Note
• https://bdu.fstec.ru/vul/2022-02605 · Security Note
• http://xforce.iss.net/xforce/xfdb/64963 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64963 · Note
• http://php.net/ChangeLog-5.php · Note
• http://coding.derkeiler.com/Archive/PHP/php.general/2007-04/msg00605.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4699 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12393 · Note
• http://bugs.php.net/52941 · Note