PT-2011-2344 · Debian+1 · Debian+1

Published 2011-03-29 · Updated 2017-08-17 · CVE-2011-0441

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP version 5.3.5

Description The issue allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/. This is related to the Debian GNU/Linux /etc/cron.d/php5 cron job.

Recommendations For PHP version 5.3.5, consider restricting access to the /var/lib/php5/ directory to prevent symlink attacks until a patch is available. As a temporary workaround, monitor the cron job's activity closely to detect any potential misuse.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2011-0441

DSA-2195-1

Affected Products

Debian

Php

References · 8

• http://mandriva.com/security/advisories?name=MDVSA-2011:069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0441 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618489 · Patch
• http://securityfocus.com/bid/46928 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66180 · Note
• http://vupen.com/english/advisories/2011/0910 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0441 · Note
• http://git.debian.org/?p=pkg-php/php.git%3Ba=commit%3Bh=d09fd04ed7bfcf7f008360c6a42025108925df09 · Note