Summary
PHP is prone to multiple format-string vulnerabilities because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.
Attackers can exploit these issues to run arbitrary code within the context of the PHP process. This may allow them to bypass intended security restrictions or gain elevated privileges.
PHP 5.3 through 5.3.2 are vulnerable.
Solution
Updates are available
please see the references for details.
References
- http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html
- http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.html
- http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.html
- http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.html
- http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html
- http://svn.php.net/viewvc?view=revision&revision=298667
- http://www.mail-archive.com/php-cvs@lists.php.net/msg46330.html
- http://www.php.net
- http://www.securityfocus.com/bid/40173
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2010-2094, CVE-2010-2950 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Abtp Portal Project 'ABTPV_BLOQUE_CENT' Parameter Local and Remote File Include Vulnerabilities
- Apache Tomcat Information Disclosure Vulnerability
- Apache ActiveMQ Source Code Information Disclosure Vulnerability
- Andromeda Streaming MP3 Server Cross Site Scripting Vulnerability
- Adobe ColdFusion Multiple Full Path Disclosure Vulnerabilities