CVE-2001-1246

PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.iss.net/security_center/static/6787.php	Patch Vendor Advisory
http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz
http://online.securityfocus.com/archive/1/194425
http://www.redhat.com/support/errata/RHSA-2002-102.html
http://www.redhat.com/support/errata/RHSA-2002-129.html
http://www.redhat.com/support/errata/RHSA-2003-159.html
http://www.securityfocus.com/bid/2954

Configurations

Configuration 1 (hide)

cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*

Information

Published : 2001-06-30 04:00

Updated : 2008-09-10 19:10

NVD link : CVE-2001-1246

Mitre link : CVE-2001-1246

JSON object : View

Products Affected

php

php

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.iss.net/security_center/static/6787.php", "name": "php-safemode-elevate-privileges(6787)", "tags": ["Patch", "Vendor Advisory"], "refsource": "XF"}, {"url": "http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz", "name": "http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz", "tags": [], "refsource": "CONFIRM"}, {"url": "http://online.securityfocus.com/archive/1/194425", "name": "20010630 php breaks safe mode", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.redhat.com/support/errata/RHSA-2002-102.html", "name": "RHSA-2002:102", "tags": [], "refsource": "REDHAT"}, {"url": "http://www.redhat.com/support/errata/RHSA-2002-129.html", "name": "RHSA-2002:129", "tags": [], "refsource": "REDHAT"}, {"url": "http://www.redhat.com/support/errata/RHSA-2003-159.html", "name": "RHSA-2003:159", "tags": [], "refsource": "REDHAT"}, {"url": "http://www.securityfocus.com/bid/2954", "name": "2954", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2001-1246", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2001-06-30T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-09-10T19:10Z"}