AplusWebMaster
Topic Starter
FYI…
- http://preview.tinyurl.com/5zvnrx
May 9, 2008 (Avert Labs blog) - "Sometime back we had come across this interesting vulnerability posted by a Chinese researcher in his blog, claiming to have found a zero day vulnerability in php 5.2.3. We got a chance to dig a bit deeper into this and were able to reproduce the vulnerability based on the information provided in the blog. After investigation, we found that this vulnerablility affects not only verion 5.2.3 but also version 5.2.5. It is a heap overflow which can be triggered when a web server with PHP receives a malformed URI request, it can be a simple request like “GET /index.php/aa HTTP/1.1″ . Successful exploitation of this can result in arbitrary code execution with the privileges of the WEB Server… We highly recommend users to update with the latest version of PHP 5.2.6 released*. This patch besides this issue, fixes a host of other security related fixes, some of which we deem as critical…"
* http://forums.whatthetech.com/PHP_security…tes_t91434.html
- http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0599
Last revised: 5/9/2008
CVSS v2 Base score: 10.0 (High)
- http://preview.tinyurl.com/5zvnrx
May 9, 2008 (Avert Labs blog) - "Sometime back we had come across this interesting vulnerability posted by a Chinese researcher in his blog, claiming to have found a zero day vulnerability in php 5.2.3. We got a chance to dig a bit deeper into this and were able to reproduce the vulnerability based on the information provided in the blog. After investigation, we found that this vulnerablility affects not only verion 5.2.3 but also version 5.2.5. It is a heap overflow which can be triggered when a web server with PHP receives a malformed URI request, it can be a simple request like “GET /index.php/aa HTTP/1.1″ . Successful exploitation of this can result in arbitrary code execution with the privileges of the WEB Server… We highly recommend users to update with the latest version of PHP 5.2.6 released*. This patch besides this issue, fixes a host of other security related fixes, some of which we deem as critical…"
* http://forums.whatthetech.com/PHP_security…tes_t91434.html
- http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0599
Last revised: 5/9/2008
CVSS v2 Base score: 10.0 (High)