CVE-2004-1064 The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue...
HighCVSS 10.0
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | >= 4.0.0, <= 4.3.9 | No fix listed |
| PHP | >= 5.0.0, <= 5.0.2 | No fix listed |
| Canonical Ubuntu Linux | = 4.10 | No fix listed |
References
- CLA-2005:915 broken-link vendor-advisory
- GLSA-200412-14 third-party-advisory vendor-advisory
- www.hardened-php.net third-party-advisory
- MDKSA-2004:151 third-party-advisory vendor-advisory
- MDKSA-2005:072 third-party-advisory vendor-advisory
- www.php.net release-notes vendor-advisory
- HPSBMA01212 third-party-advisory vdb-entry vendor-advisory
- 20041215 Advisory 01/2004: Multiple vulnerabilities in PHP 4/5 mailing-list third-party-advisory vdb-entry
- 11964 third-party-advisory vdb-entry
- php-realpath-safemode-bypass(18512) third-party-advisory vdb-entry
- USN-99-1 third-party-advisory vendor-advisory
- USN-99-2 third-party-advisory vendor-advisory