CVE

Id
9492  
CVE No.
CVE-2004-1064  
Status
Candidate  
Description
The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.  
Phase
Assigned (20041123)  
Votes
REVIEWING(1) Christey  
Comments
Christey> There is active disagreement regarding whether this satisfies the | criteria for inclusion in CVE, because the attack vectors require | function parameters that are typically controlled only by the | application developer, not an external attacker. This would mean that | only the PHP application owner could exploit it. | | Since various PHP functions already allow the application owner to | execute commands, no additional privileges would be gained by | exploiting such a bug. However, if safe_mode is enabled in PHP, then | the PHP functions related to execution are restricted | (e.g. shell_exec()). Thus, exploitation may allow the PHP application | owner to execute code *despite* the configured restrictions imposed by | safe mode, which then qualifies this as a vulnerability.  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
63922 9492 CVE-2004-1064 BUGTRAQ:20041215 Advisory 01/2004: Multiple vulnerabilities in PHP 4/5  View
63923 9492 CVE-2004-1064 URL:http://www.securityfocus.com/archive/1/384545  View
63924 9492 CVE-2004-1064 MISC:http://www.hardened-php.net/advisories/012004.txt  View
63925 9492 CVE-2004-1064 CONFIRM:http://www.php.net/release_4_3_10.php  View
63926 9492 CVE-2004-1064 CONECTIVA:CLA-2005:915  View
63927 9492 CVE-2004-1064 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915  View
63928 9492 CVE-2004-1064 GENTOO:GLSA-200412-14  View
63929 9492 CVE-2004-1064 URL:http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml  View
63930 9492 CVE-2004-1064 HP:HPSBMA01212  View
63931 9492 CVE-2004-1064 URL:http://www.securityfocus.com/advisories/9028  View
63932 9492 CVE-2004-1064 MANDRAKE:MDKSA-2004:151  View
63933 9492 CVE-2004-1064 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2004:151  View
63934 9492 CVE-2004-1064 MANDRAKE:MDKSA-2005:072  View
63935 9492 CVE-2004-1064 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2005:072  View
63936 9492 CVE-2004-1064 UBUNTU:USN-99-1  View
63937 9492 CVE-2004-1064 URL:https://www.ubuntu.com/usn/usn-99-1/  View
63938 9492 CVE-2004-1064 UBUNTU:USN-99-2  View
63939 9492 CVE-2004-1064 URL:https://www.ubuntu.com/usn/usn-99-2/  View
63940 9492 CVE-2004-1064 BID:11964  View
63941 9492 CVE-2004-1064 URL:http://www.securityfocus.com/bid/11964  View
63942 9492 CVE-2004-1064 XF:php-realpath-safemode-bypass(18512)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63201 JVNDB-2004-000543 PHP の exif_read_data 関数におけるバッファオーバーフローの脆弱性 ------------ CVE-2004-1065 9492 10 http://jvndb.jvn.jp/ja/contents/2004/JVNDB-2004-000543.html  View