PT-2014-2037 · Php · Php

Kurt Seifried · Published 2014-02-15 · Updated 2014-02-18 · CVE-2012-1171

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.x

Description The issue allows remote attackers to bypass the open basedir protection mechanism and read arbitrary files. This is achieved through vectors involving a stream close method call during the use of a custom stream wrapper. The exploitation of this issue may allow a remote attacker to disclose protected information by reading arbitrary files.

Recommendations For PHP version 5.x, consider disabling custom stream wrappers until a patch is available to prevent the exploitation of this issue. Restrict access to sensitive files and directories to minimize the risk of arbitrary file reading. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-02602

CVE-2012-1171

Affected Products

Php

References · 7

• https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-read.phpt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1171 · Security Note
• https://bdu.fstec.ru/vul/2022-02602 · Security Note
• https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-write.phpt · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=802591 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1171 · Note
• https://bugs.php.net/bug.php?id=61367 · Note