CVE-2010-3870

The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html	Exploit Third Party Advisory
http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:224	Third Party Advisory
http://bugs.php.net/bug.php?id=48230	Exploit Vendor Advisory
http://us2.php.net/manual/en/function.utf8-decode.php#83935	Exploit Vendor Advisory
http://www.openwall.com/lists/oss-security/2010/11/02/8	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/11/02/11	Mailing List Third Party Advisory
http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/	Exploit Third Party Advisory
http://bugs.php.net/bug.php?id=49687	Exploit Vendor Advisory
http://www.openwall.com/lists/oss-security/2010/11/02/4	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/11/02/6	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/11/03/1	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/11/02/1	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/11/02/2	Mailing List Third Party Advisory
http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf	Exploit Third Party Advisory
http://svn.php.net/viewvc?view=revision&revision=304959	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0919.html	Third Party Advisory
http://www.securityfocus.com/bid/44605	Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1024797	Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2010/3081	Third Party Advisory
http://secunia.com/advisories/42410	Third Party Advisory
http://www.vupen.com/english/advisories/2011/0020	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html	Mailing List Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html	Mailing List Third Party Advisory
http://www.php.net/ChangeLog-5.php	Vendor Advisory
http://www.ubuntu.com/usn/USN-1042-1	Third Party Advisory
http://secunia.com/advisories/42812	Third Party Advisory
http://www.vupen.com/english/advisories/2011/0021	Third Party Advisory
http://www.vupen.com/english/advisories/2011/0077	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0195.html	Third Party Advisory
http://support.apple.com/kb/HT4581	Third Party Advisory
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html	Mailing List Third Party Advisory
http://marc.info/?l=bugtraq&m=133469208622507&w=2	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php::::::::

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:10.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:8.04::::-:::
	cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::
	cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*

Information

Published : 2010-11-12 13:00

Updated : 2023-02-12 20:27

NVD link : CVE-2010-3870

Mitre link : CVE-2010-3870

JSON object : View

CWE

CWE-20

Improper Input Validation

Products Affected

canonical

ubuntu_linux

php

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html", "name": "http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:224", "name": "MDVSA-2010:224", "tags": ["Third Party Advisory"], "refsource": "MANDRIVA"}, {"url": "http://bugs.php.net/bug.php?id=48230", "name": "http://bugs.php.net/bug.php?id=48230", "tags": ["Exploit", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://us2.php.net/manual/en/function.utf8-decode.php#83935", "name": "http://us2.php.net/manual/en/function.utf8-decode.php#83935", "tags": ["Exploit", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.openwall.com/lists/oss-security/2010/11/02/8", "name": "[oss-security] 20101102 Re: utf-8 security issue in php", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2010/11/02/11", "name": "[oss-security] 20101102 Re: utf-8 security issue in php", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/", "name": "http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://bugs.php.net/bug.php?id=49687", "name": "http://bugs.php.net/bug.php?id=49687", "tags": ["Exploit", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2010/11/02/4", "name": "[oss-security] 20101102 Re: utf-8 security issue in php", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2010/11/02/6", "name": "[oss-security] 20101102 Re: utf-8 security issue in php", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2010/11/03/1", "name": "[oss-security] 20101103 Re: utf-8 security issue in php", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2010/11/02/1", "name": "[oss-security] 20101102 utf-8 security issue in php", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2010/11/02/2", "name": "[oss-security] 20101102 Re: utf-8 security issue in php", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf", "name": "http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://svn.php.net/viewvc?view=revision&revision=304959", "name": "http://svn.php.net/viewvc?view=revision&revision=304959", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.redhat.com/support/errata/RHSA-2010-0919.html", "name": "RHSA-2010:0919", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "http://www.securityfocus.com/bid/44605", "name": "44605", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id?1024797", "name": "1024797", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://www.vupen.com/english/advisories/2010/3081", "name": "ADV-2010-3081", "tags": ["Third Party Advisory"], "refsource": "VUPEN"}, {"url": "http://secunia.com/advisories/42410", "name": "42410", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2011/0020", "name": "ADV-2011-0020", "tags": ["Third Party Advisory"], "refsource": "VUPEN"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html", "name": "FEDORA-2010-18976", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html", "name": "FEDORA-2010-19011", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html", "name": "SUSE-SR:2010:023", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "SUSE"}, {"url": "http://www.php.net/ChangeLog-5.php", "name": "http://www.php.net/ChangeLog-5.php", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.ubuntu.com/usn/USN-1042-1", "name": "USN-1042-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "http://secunia.com/advisories/42812", "name": "42812", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2011/0021", "name": "ADV-2011-0021", "tags": ["Third Party Advisory"], "refsource": "VUPEN"}, {"url": "http://www.vupen.com/english/advisories/2011/0077", "name": "ADV-2011-0077", "tags": ["Third Party Advisory"], "refsource": "VUPEN"}, {"url": "http://www.redhat.com/support/errata/RHSA-2011-0195.html", "name": "RHSA-2011:0195", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "http://support.apple.com/kb/HT4581", "name": "http://support.apple.com/kb/HT4581", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html", "name": "APPLE-SA-2011-03-21-1", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "APPLE"}, {"url": "http://marc.info/?l=bugtraq&m=133469208622507&w=2", "name": "SSRT100826", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "HP"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-3870", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2010-11-12T21:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.2.14"}, {"cpe23Uri": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.3.4", "versionStartIncluding": "5.3.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-02-13T04:27Z"}

6.8 /10