CVE-2004-1064

The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/archive/1/384545	Third Party Advisory VDB Entry
http://www.hardened-php.net/advisories/012004.txt	Third Party Advisory
http://www.php.net/release_4_3_10.php	Release Notes Vendor Advisory
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915	Broken Link
http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml	Third Party Advisory
http://www.securityfocus.com/bid/11964	Third Party Advisory VDB Entry
http://www.securityfocus.com/advisories/9028	Third Party Advisory VDB Entry
http://www.mandriva.com/security/advisories?name=MDKSA-2004:151	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:072	Third Party Advisory
https://www.ubuntu.com/usn/usn-99-1/	Third Party Advisory
https://www.ubuntu.com/usn/usn-99-2/	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/18512	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::

Configuration 2 (hide)

cpe:2.3:o:canonical:ubuntu_linux:4.10:*:*:*:*:*:*:*

Information

Published : 2005-01-09 21:00

Updated : 2020-12-08 10:56

NVD link : CVE-2004-1064

Mitre link : CVE-2004-1064

JSON object : View

CWE

NVD-CWE-noinfo

Advertisement

Products Affected

canonical

ubuntu_linux

php

php

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/archive/1/384545", "name": "20041215 Advisory 01/2004: Multiple vulnerabilities in PHP 4/5", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BUGTRAQ"}, {"url": "http://www.hardened-php.net/advisories/012004.txt", "name": "http://www.hardened-php.net/advisories/012004.txt", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.php.net/release_4_3_10.php", "name": "http://www.php.net/release_4_3_10.php", "tags": ["Release Notes", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915", "name": "CLA-2005:915", "tags": ["Broken Link"], "refsource": "CONECTIVA"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml", "name": "GLSA-200412-14", "tags": ["Third Party Advisory"], "refsource": "GENTOO"}, {"url": "http://www.securityfocus.com/bid/11964", "name": "11964", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securityfocus.com/advisories/9028", "name": "HPSBMA01212", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "HP"}, {"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:151", "name": "MDKSA-2004:151", "tags": ["Third Party Advisory"], "refsource": "MANDRAKE"}, {"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:072", "name": "MDKSA-2005:072", "tags": ["Third Party Advisory"], "refsource": "MANDRAKE"}, {"url": "https://www.ubuntu.com/usn/usn-99-1/", "name": "USN-99-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "https://www.ubuntu.com/usn/usn-99-2/", "name": "USN-99-2", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18512", "name": "php-realpath-safemode-bypass(18512)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2004-1064", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-01-10T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.3.9", "versionStartIncluding": "4.0.0"}, {"cpe23Uri": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "5.0.2", "versionStartIncluding": "5.0.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:4.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-12-08T18:56Z"}