CVSS: 7.5EPSS: 2%CPEs: 110EXPL: 2CVE-2009-4018 – Kolang 4.3.10 < 5.3.0 - 'proc_open()' PHP 'safe_mode' Bypass
https://notcve.org/view.php?id=CVE-2009-4018
The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable. La función proc_open en ext/standard/proc_open.c en PHP anterior a v5.2.11 y v5.3.x anterior a v5.3.1 no aplica adecuadamente las directivas (1) safe_mode_allowed_env_vars y (2) safe_mode_protected_env_vars, lo que permite dependientes del contexto a atacantes ejecutar programas con un entorno de su elección a través del parámetro env, como se ha demostrado por un valor manipulado de la variable del entorno LD_LIBRARY_PATH. • https://www.exploit-db.com/exploits/11636 http://bugs.php.net/bug.php?id=49026 http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://marc.info/?l=oss-security&m=125886770008678&w=2 http://marc.info/?l=oss-security&m=125897935330618&w=2 http://secunia.com/advisories/40262 http://secunia.com/advisories/41480 http://secunia.com/advisories/41490 http://svn.php.net/viewvc/? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 5%CPEs: 14EXPL: 1CVE-2009-4017 – PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service
https://notcve.org/view.php?id=CVE-2009-4017
PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive. PHP v5.2.11, y v5.3.x antes de v5.3.1, no restringen el número de archivos temporales creados al manipular una solicitud POST multipart/form-data, lo que permite a atacantes remotos causar una denegación de servicio (por agotamiento de recursos), y facilita a los atacantes remotos aprovecharse de las vulnerabilidades de inclusión de archivos locales, a través de múltiples peticiones, en relación a la falta de apoyo a la directiva max_file_uploads. • https://www.exploit-db.com/exploits/10242 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://news.php.net/php.announce/79 http://seclists.org/fulldisclosure/2009/Nov/228 http://secunia.com/advisories/37482 http://secunia.com/advisories/37821 http://secunia.com/advisories/40262 http://secunia.com/advisories/41480 http://secunia.com/advisories/41490 http://support.apple.com/kb/HT4077 ht • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.8EPSS: 1%CPEs: 62EXPL: 1CVE-2009-3558
https://notcve.org/view.php?id=CVE-2009-3558
The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file. La función posix_mkfifo de ext/posix/posix.c de PHP v5.2.11 y anteriores, y v5.3.x anteriores a la v5.3.1, permite a atacantes dependiendo del contexto evitar las restricciones open_basedir, y crear ficheros FIFO, a través de los argumentos "pathname" y "mode", como se ha demostrado creando un fichero .htaccess. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://news.php.net/php.announce/79 http://secunia.com/advisories/37412 http://secunia.com/advisories/37821 http://securityreason.com/securityalert/6600 http://support.apple.com/kb/HT4077 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/posix/posix.c?view=log http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/posix/posix.c?view=log http://svn.php.net/viewvc?v • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 63EXPL: 1CVE-2009-3557
https://notcve.org/view.php?id=CVE-2009-3557
The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments. La función tempnam de ext/standard/file.c de PHP v5.2.11 y anteriores, y v5.3.x anteriores a v5.3.1, permite a usuarios dependiendo del contexto evitar las restricciones safe_mode, y crear ficheros en directorios con permisos de sistema operativo de escritura para su grupo o para cualquier usuario, a través de los argumentos dir y prefix. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://news.php.net/php.announce/79 http://secunia.com/advisories/37412 http://secunia.com/advisories/37821 http://secunia.com/advisories/40262 http://securityreason.com/securityalert/6601 http://support.apple.com/kb/HT4077 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/standard/file.c?view=log http://svn.php.net/viewvc/p • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2009-3559
https://notcve.org/view.php?id=CVE-2009-3559
main/streams/plain_wrapper.c in PHP 5.3.x before 5.3.1 does not recognize the safe_mode_include_dir directive, which allows context-dependent attackers to have an unknown impact by triggering the failure of PHP scripts that perform include or require operations, as demonstrated by a script that attempts to perform a require_once on a file in a standard library directory. NOTE: a reliable third party reports that this is not a vulnerability, because it results in a more restrictive security policy. ** EN DISPUTA ** main / streams / plain_wrapper.c en PHP 5.3.x anterior a 5.3.1 no reconoce la directiva safe_mode_include_dir, que permite que los atacantes dependientes del contexto tengan un impacto desconocido al desencadenar la falla de los scripts PHP que incluyen incluir o requiere operaciones, como lo demuestra un script que intenta realizar un require_once en un archivo en un directorio de biblioteca estándar. NOTA: un tercero confiable informa que esto no es una vulnerabilidad, ya que resulta en una política de seguridad más restrictiva. • http://bugs.php.net/bug.php?id=50063 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://news.php.net/php.announce/79 http://support.apple.com/kb/HT4077 http://www.mandriva.com/security/advisories?name=MDVSA-2009:302 http://www.openwall.com/lists/oss-security/2009/11/20/2 http://www.openwall.com/lists/oss-security/2009/11/20/3 http://www.openwall.com/lists/oss-security/2009/11/20/5 http://www.php.net/ChangeLog-5.php&# •