CVE-2009-3294

The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.osvdb.org/58188	Broken Link
http://www.php.net/releases/5_2_11.php	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/20/1	Mailing List Patch
http://svn.php.net/viewvc?view=revision&revision=287779	Vendor Advisory
http://bugs.php.net/bug.php?id=44683	Exploit Vendor Advisory
http://www.php.net/ChangeLog-5.php#5.2.11	Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/11/20/2	Mailing List
http://www.openwall.com/lists/oss-security/2009/11/20/3	Mailing List
http://www.php.net/ChangeLog-5.php	Vendor Advisory
http://www.php.net/releases/5_3_1.php	Vendor Advisory
http://news.php.net/php.announce/79	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::

OR	cpe:2.3:o:microsoft:windows_server_2008::::::::
	cpe:2.3:o:microsoft:windows_7::::::::
	cpe:2.3:o:microsoft:windows_xp::::::::

Information

Published : 2009-09-22 03:30

Updated : 2022-09-01 09:32

NVD link : CVE-2009-3294

Mitre link : CVE-2009-3294

JSON object : View

CWE

CWE-134

Use of Externally-Controlled Format String

Products Affected

microsoft

windows_xp
windows_server_2008
windows_7

php

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.osvdb.org/58188", "name": "58188", "tags": ["Broken Link"], "refsource": "OSVDB"}, {"url": "http://www.php.net/releases/5_2_11.php", "name": "http://www.php.net/releases/5_2_11.php", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2009/09/20/1", "name": "[oss-security] 20090920 Re: CVE Request -- PHP 5 - 5.2.11", "tags": ["Mailing List", "Patch"], "refsource": "MLIST"}, {"url": "http://svn.php.net/viewvc?view=revision&revision=287779", "name": "http://svn.php.net/viewvc?view=revision&revision=287779", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://bugs.php.net/bug.php?id=44683", "name": "http://bugs.php.net/bug.php?id=44683", "tags": ["Exploit", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.php.net/ChangeLog-5.php#5.2.11", "name": "http://www.php.net/ChangeLog-5.php#5.2.11", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2009/11/20/2", "name": "[oss-security] 20091120 CVE request: php 5.3.1 update", "tags": ["Mailing List"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2009/11/20/3", "name": "[oss-security] 20091120 Re: CVE request: php 5.3.1 update", "tags": ["Mailing List"], "refsource": "MLIST"}, {"url": "http://www.php.net/ChangeLog-5.php", "name": "http://www.php.net/ChangeLog-5.php", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.php.net/releases/5_3_1.php", "name": "http://www.php.net/releases/5_3_1.php", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://news.php.net/php.announce/79", "name": "[php-announce] 20091119 5.3.1 Release announcement", "tags": ["Vendor Advisory"], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) \"e\" or (2) \"er\" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-134"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-3294", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-09-22T10:30Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.2.11", "versionStartIncluding": "5.2.0"}, {"cpe23Uri": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.3.1", "versionStartIncluding": "5.3.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-09-01T16:32Z"}

5.0 /10