CVE-2008-0599 The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attack...
CriticalCVSS 9.8
EPSS 10.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | < 5.2.6 | 5.2.6 |
| fedoraproject fedora | = 8 | No fix listed |
| fedoraproject fedora | = 9 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| Canonical Ubuntu Linux | = 7.10 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| apple mac os x | < 10.5.4 | 10.5.4 |
| apple mac os x server | < 10.5.4 | 10.5.4 |
References
- cvs.php.net broken-link exploit
- HPSBUX02342 broken-link vendor-advisory
- APPLE-SA-2008-07-31 mailing-list vendor-advisory
- SSRT090085 mailing-list vendor-advisory
- HPSBUX02465 mailing-list vendor-advisory
- 30048 broken-link third-party-advisory vendor-advisory
- 30083 broken-link third-party-advisory
- 30345 broken-link third-party-advisory vendor-advisory
- 30616 broken-link third-party-advisory
- 30757 broken-link third-party-advisory
- 30828 broken-link third-party-advisory
- 31200 broken-link third-party-advisory
- 31326 broken-link third-party-advisory
- 32746 broken-link third-party-advisory
- 35650 broken-link third-party-advisory
- GLSA-200811-05 third-party-advisory vendor-advisory
- wiki.rpath.com broken-link
- VU#147027 third-party-advisory us-government-resource
- MDVSA-2008:127 broken-link vendor-advisory
- MDVSA-2008:128 broken-link vendor-advisory
- [oss-security] 20080502 CVE Request (PHP) mailing-list
- www.php.net release-notes
- RHSA-2008:0505 broken-link vendor-advisory
- 20080523 rPSA-2008-0176-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl broken-link mailing-list third-party-advisory vdb-entry
- 29009 broken-link third-party-advisory vdb-entry
- 1019958 broken-link third-party-advisory vdb-entry
- SSA:2008-128-01 broken-link vendor-advisory
- USN-628-1 third-party-advisory vendor-advisory
- ADV-2008-1412 broken-link vdb-entry
- ADV-2008-1810 broken-link vdb-entry
- ADV-2008-2268 broken-link vdb-entry
- php-vector-unspecified(42137) third-party-advisory vdb-entry
- issues.rpath.com broken-link
- oval:org.mitre.oval:def:5510 broken-link signature vdb-entry
- FEDORA-2008-3864 mailing-list vendor-advisory
- FEDORA-2008-3606 mailing-list vendor-advisory