NVD

Id
7787  
Name
CVE-2011-0754  
Description
The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack of a FILE_ATTRIBUTE_REPARSE_POINT check.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-02-02  
Modified Date
2011-07-18  
Seq
2011-0754  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
44304 7787 CVE-2011-0754 http://bugs.php.net/51763  View
44305 7787 CVE-2011-0754 oval:org.mitre.oval:def:12334  View
44306 7787 CVE-2011-0754 http://www.php.net/ChangeLog-5.php  View
44307 7787 CVE-2011-0754 php-splfileinfogettype-symlink(65429)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36984 JVNDB-2010-002764 PHP の SplFileInfo::getType 関数におけるシンボリックリンク攻撃の脆弱性 Windows 上で稼働している PHP の Standard PHP Library (SPL) 拡張内にある SplFileInfo::getType 関数は、シンボリックリンクを適切に検出しないため、シンボリックリンク攻撃を誘導される脆弱性が存在します。 CVE-2011-0754 48661 CVE-2011-0754 7787 4.4 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002764.html 2010-12-09 2011-03-01 View