CVE-2009-3294

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.

La función popen de la API en el archivo TSRM/tsrm_win32.c en PHP anterior a versión 5.2.11 y versión 5.3.x anterior a 5.3.1, cuando se ejecuta en ciertos sistemas operativos de Windows, permite que los atacantes dependiendo del contexto causen una denegación de servicio (bloqueo) mediante una cadena (1) "e" o (2) "er" en el segundo argumento (también se conoce como modo), posiblemente relacionado a la función _fdopen en la biblioteca runtime de Microsoft C. NOTA: esto podría no cruzar los límites de privilegios, excepto en casos excepcionales en los que el argumento mode es accesible para un atacante fuera de una aplicación que utiliza la función popen.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-09-22 CVE Reserved
2009-09-22 CVE Published
2023-03-07 EPSS Updated
2024-08-07 CVE Updated
2024-08-07 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-134: Use of Externally-Controlled Format String

CAPEC

References (11)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2009/11/20/2	Mailing List
http://www.openwall.com/lists/oss-security/2009/11/20/3	Mailing List
http://www.osvdb.org/58188	Broken Link

URL	Date	SRC
http://bugs.php.net/bug.php?id=44683	2024-08-07

URL	Date	SRC
http://www.openwall.com/lists/oss-security/2009/09/20/1	2022-09-01
http://www.php.net/releases/5_2_11.php	2022-09-01

URL	Date	SRC
http://news.php.net/php.announce/79	2022-09-01
http://svn.php.net/viewvc?view=revision&revision=287779	2022-09-01
http://www.php.net/ChangeLog-5.php	2022-09-01
http://www.php.net/ChangeLog-5.php#5.2.11	2022-09-01
http://www.php.net/releases/5_3_1.php	2022-09-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Php Search vendor "Php"	Php Search vendor "Php" for product "Php"	>= 5.2.0 < 5.2.11 Search vendor "Php" for product "Php" and version " >= 5.2.0 < 5.2.11"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 7 Search vendor "Microsoft" for product "Windows 7"	*	-	Safe
Php Search vendor "Php"	Php Search vendor "Php" for product "Php"	>= 5.2.0 < 5.2.11 Search vendor "Php" for product "Php" and version " >= 5.2.0 < 5.2.11"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008"	*	-	Safe
Php Search vendor "Php"	Php Search vendor "Php" for product "Php"	>= 5.2.0 < 5.2.11 Search vendor "Php" for product "Php" and version " >= 5.2.0 < 5.2.11"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	-	Safe
Php Search vendor "Php"	Php Search vendor "Php" for product "Php"	>= 5.3.0 < 5.3.1 Search vendor "Php" for product "Php" and version " >= 5.3.0 < 5.3.1"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows 7 Search vendor "Microsoft" for product "Windows 7"	*	-	Safe
Php Search vendor "Php"	Php Search vendor "Php" for product "Php"	>= 5.3.0 < 5.3.1 Search vendor "Php" for product "Php" and version " >= 5.3.0 < 5.3.1"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008"	*	-	Safe
Php Search vendor "Php"	Php Search vendor "Php" for product "Php"	>= 5.3.0 < 5.3.1 Search vendor "Php" for product "Php" and version " >= 5.3.0 < 5.3.1"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Xp Search vendor "Microsoft" for product "Windows Xp"	*	-	Safe