5.1 - CVE-2004-0594

Executive Summary

Informations
Name	CVE-2004-0594	First vendor Publication	2004-07-27
Vendor	Cve	Last vendor Modification	2024-02-15

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Cvss Base Score	5.1	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	High
Cvss Expoit Score	4.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0594

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-27	Leveraging Race Conditions via Symbolic Links
CAPEC-29	Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-367	Time-of-check Time-of-use (TOCTOU) Race Condition

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10896

Oval ID:	oval:org.mitre.oval:def:10896
Title:	The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.
Description:	The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0594	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section php is earlier than 0:4.3.2-11.1.ent AND php-pgsql is earlier than 0:4.3.2-11.1.ent AND php-mysql is earlier than 0:4.3.2-11.1.ent AND php-ldap is earlier than 0:4.3.2-11.1.ent AND php-imap is earlier than 0:4.3.2-11.1.ent AND php-odbc is earlier than 0:4.3.2-11.1.ent

CPE : Common Platform Enumeration

Type	Description	Count
Application	Openpkg cpe:2.3:a:openpkg:openpkg:2.1:::::::* cpe:2.3:a:openpkg:openpkg:2.0:::::::*	2
Application	Php cpe:2.3:a:php:php:5.0.0:beta3:::::: cpe:2.3:a:php:php:5.0.0:beta1:::::: cpe:2.3:a:php:php:5.0.0:beta4:::::: cpe:2.3:a:php:php:5.0.0:rc1:::::: cpe:2.3:a:php:php:5.0.0:beta2:::::: cpe:2.3:a:php:php:5.0.0:rc2:::::: cpe:2.3:a:php:php:4.3.6:-:::::: cpe:2.3:a:php:php:4.3.6:rc1:::::: cpe:2.3:a:php:php:4.3.6:rc2:::::: cpe:2.3:a:php:php:4.3.6:rc3:::::: cpe:2.3:a:php:php:4.3.5:-:::::: cpe:2.3:a:php:php:4.3.5:rc1:::::: cpe:2.3:a:php:php:4.3.5:rc2:::::: cpe:2.3:a:php:php:4.3.5:rc3:::::: cpe:2.3:a:php:php:4.3.5:rc4:::::: cpe:2.3:a:php:php:4.3.4:-:::::: cpe:2.3:a:php:php:4.3.4:rc1:::::: cpe:2.3:a:php:php:4.3.4:rc2:::::: cpe:2.3:a:php:php:4.3.4:rc3:::::: cpe:2.3:a:php:php:4.3.3:-:::::: cpe:2.3:a:php:php:4.3.3:rc1:::::: cpe:2.3:a:php:php:4.3.3:rc2:::::: cpe:2.3:a:php:php:4.3.3:rc3:::::: cpe:2.3:a:php:php:4.3.3:rc4:::::: cpe:2.3:a:php:php:4.3.2:-:::::: cpe:2.3:a:php:php:4.3.2:rc1:::::: cpe:2.3:a:php:php:4.3.2:rc2:::::: cpe:2.3:a:php:php:4.3.2:rc3:::::: cpe:2.3:a:php:php:4.3.2:rc4:::::: cpe:2.3:a:php:php:4.3.1:::::::* cpe:2.3:a:php:php:4.3.0:-:::::: cpe:2.3:a:php:php:4.3.0:alpha1:::::: cpe:2.3:a:php:php:4.3.0:alpha2:::::: cpe:2.3:a:php:php:4.3.0:alpha3:::::: cpe:2.3:a:php:php:4.3.0:dev:::::: cpe:2.3:a:php:php:4.3.0:pre1:::::: cpe:2.3:a:php:php:4.3.0:pre2:::::: cpe:2.3:a:php:php:4.3.0:rc1:::::: cpe:2.3:a:php:php:4.3.0:rc2:::::: cpe:2.3:a:php:php:4.3.0:rc3:::::: cpe:2.3:a:php:php:4.3.0:rc4:::::: cpe:2.3:a:php:php:4.2.3:-:::::: cpe:2.3:a:php:php:4.2.3:rc1:::::: cpe:2.3:a:php:php:4.2.3:rc2:::::: cpe:2.3:a:php:php:4.2.2:::::::* cpe:2.3:a:php:php:4.2.1:-:::::: cpe:2.3:a:php:php:4.2.1:rc1:::::: cpe:2.3:a:php:php:4.2.1:rc2:::::: cpe:2.3:a:php:php:4.2.0:-:::::: cpe:2.3:a:php:php:4.2.0:rc1:::::: cpe:2.3:a:php:php:4.2.0:rc2:::::: cpe:2.3:a:php:php:4.2.0:rc3:::::: cpe:2.3:a:php:php:4.2.0:rc4:::::: cpe:2.3:a:php:php:4.2::dev::::: cpe:2.3:a:php:php:4.1.2:::::::* cpe:2.3:a:php:php:4.1.1:::::::* cpe:2.3:a:php:php:4.1.0:-:::::: cpe:2.3:a:php:php:4.1.0:rc1:::::: cpe:2.3:a:php:php:4.1.0:rc2:::::: cpe:2.3:a:php:php:4.1.0:rc3:::::: cpe:2.3:a:php:php:4.1.0:rc4:::::: cpe:2.3:a:php:php:4.1.0:rc5:::::: cpe:2.3:a:php:php:4.0.7:rc3:::::: cpe:2.3:a:php:php:4.0.7:rc2:::::: cpe:2.3:a:php:php:4.0.7:rc4:::::: cpe:2.3:a:php:php:4.0.7:rc1:::::: cpe:2.3:a:php:php:4.0.7:-:::::: cpe:2.3:a:php:php:4.0.6:-:::::: cpe:2.3:a:php:php:4.0.6:rc1:::::: cpe:2.3:a:php:php:4.0.6:rc2:::::: cpe:2.3:a:php:php:4.0.6:rc3:::::: cpe:2.3:a:php:php:4.0.6:rc4:::::: cpe:2.3:a:php:php:4.0.5:-:::::: cpe:2.3:a:php:php:4.0.5:rc1:::::: cpe:2.3:a:php:php:4.0.5:rc2:::::: cpe:2.3:a:php:php:4.0.5:rc3:::::: cpe:2.3:a:php:php:4.0.5:rc4:::::: cpe:2.3:a:php:php:4.0.5:rc5:::::: cpe:2.3:a:php:php:4.0.5:rc6:::::: cpe:2.3:a:php:php:4.0.5:rc7:::::: cpe:2.3:a:php:php:4.0.5:rc8:::::: cpe:2.3:a:php:php:4.0.4pl1:::::::* cpe:2.3:a:php:php:4.0.4:patch1:::::: cpe:2.3:a:php:php:4.0.4:-:::::: cpe:2.3:a:php:php:4.0.4:rc1:::::: cpe:2.3:a:php:php:4.0.4:rc2:::::: cpe:2.3:a:php:php:4.0.4:rc3:::::: cpe:2.3:a:php:php:4.0.4:rc4:::::: cpe:2.3:a:php:php:4.0.4:rc5:::::: cpe:2.3:a:php:php:4.0.4:rc6:::::: cpe:2.3:a:php:php:4.0.3:::::::* cpe:2.3:a:php:php:4.0.3:patch1:::::: cpe:2.3:a:php:php:4.0.3:rc1:::::: cpe:2.3:a:php:php:4.0.3:rc2:::::: cpe:2.3:a:php:php:4.0.2:::::::* cpe:2.3:a:php:php:4.0.2:rc1:::::: cpe:2.3:a:php:php:4.0.1:patch2:::::: cpe:2.3:a:php:php:4.0.1:patch1:::::: cpe:2.3:a:php:php:4.0.1:-:::::: cpe:2.3:a:php:php:4.0.1:rc:::::: cpe:2.3:a:php:php:4.0.1:rc2:::::: cpe:2.3:a:php:php:4.0.0:::::::* cpe:2.3:a:php:php:4.0:beta1:::::: cpe:2.3:a:php:php:4.0:beta2:::::: cpe:2.3:a:php:php:4.0:beta3:::::: cpe:2.3:a:php:php:4.0:beta4:::::: cpe:2.3:a:php:php:4.0:beta_4_patch1:::::: cpe:2.3:a:php:php:4.0:rc1:::::: cpe:2.3:a:php:php:4.0:rc2:::::: cpe:2.3:a:php:php:4.0:-:::::: cpe:2.3:a:php:php:4:::::::* cpe:2.3:a:php:php:3.0.9:::::::* cpe:2.3:a:php:php:3.0.8:::::::* cpe:2.3:a:php:php:3.0.7:::::::* cpe:2.3:a:php:php:3.0.6:::::::* cpe:2.3:a:php:php:3.0.5:::::::* cpe:2.3:a:php:php:3.0.4:::::::* cpe:2.3:a:php:php:3.0.3:::::::* cpe:2.3:a:php:php:3.0.2:::::::* cpe:2.3:a:php:php:3.0.18:::::::* cpe:2.3:a:php:php:3.0.17:::::::* cpe:2.3:a:php:php:3.0.16:::::::* cpe:2.3:a:php:php:3.0.15:::::::* cpe:2.3:a:php:php:3.0.14:::::::* cpe:2.3:a:php:php:3.0.13:::::::* cpe:2.3:a:php:php:3.0.12:::::::* cpe:2.3:a:php:php:3.0.11:::::::* cpe:2.3:a:php:php:3.0.10:::::::* cpe:2.3:a:php:php:3.0.1:::::::* cpe:2.3:a:php:php:3.0:::::::* cpe:2.3:a:php:php:2.0b10:::::::* cpe:2.3:a:php:php:2.0.2:::::::* cpe:2.3:a:php:php:2.0.1:::::::* cpe:2.3:a:php:php:2.0.0:-:::::: cpe:2.3:a:php:php:2.0.0:alpha1:::::: cpe:2.3:a:php:php:2.0.0:alpha2:::::: cpe:2.3:a:php:php:2.0.0:beta1:::::: cpe:2.3:a:php:php:2.0.0:rc1:::::: cpe:2.3:a:php:php:2.0:::::::* cpe:2.3:a:php:php:1.5:::::::* cpe:2.3:a:php:php:1.4:::::::* cpe:2.3:a:php:php:1.3.5:::::::* cpe:2.3:a:php:php:1.3.1:::::::* cpe:2.3:a:php:php:1.3:-:::::: cpe:2.3:a:php:php:1.3:beta2:::::: cpe:2.3:a:php:php:1.3:beta3:::::: cpe:2.3:a:php:php:1.3:beta6:::::: cpe:2.3:a:php:php:1.2.5:::::::* cpe:2.3:a:php:php:1.2.4:::::::* cpe:2.3:a:php:php:1.2.3:::::::* cpe:2.3:a:php:php:1.2.2:::::::* cpe:2.3:a:php:php:1.2.1:::::::* cpe:2.3:a:php:php:1.2.0:::::::* cpe:2.3:a:php:php:1.2:::::::* cpe:2.3:a:php:php:1.1.1:::::::* cpe:2.3:a:php:php:1.1.0:::::::* cpe:2.3:a:php:php:1.1:::::::* cpe:2.3:a:php:php:1.0.4:::::::* cpe:2.3:a:php:php:1.0.3:::::::* cpe:2.3:a:php:php:1.0.2:::::::* cpe:2.3:a:php:php:1.0.1:::::::* cpe:2.3:a:php:php:1.0.0:-:::::: cpe:2.3:a:php:php:1.0.0:rc1:::::: cpe:2.3:a:php:php:1.0:beta1:::::: cpe:2.3:a:php:php:1.0:beta2:::::: cpe:2.3:a:php:php:1.0:beta3:::::: cpe:2.3:a:php:php:1.0:rc1:::::: cpe:2.3:a:php:php:1.0:rc2:::::: cpe:2.3:a:php:php:0.91:::::::* cpe:2.3:a:php:php:0.90:::::::* cpe:2.3:a:php:php:0.9.4:::::::* cpe:2.3:a:php:php:0.9.3:::::::* cpe:2.3:a:php:php:0.9.2:::::::* cpe:2.3:a:php:php:0.9.1:::::::* cpe:2.3:a:php:php:0.9.0:::::::* cpe:2.3:a:php:php:0.9:::::::* cpe:2.3:a:php:php:0.7:::::::* cpe:2.3:a:php:php:0.6:::::::* cpe:2.3:a:php:php:0.5.3:::::::* cpe:2.3:a:php:php:0.5.2:::::::* cpe:2.3:a:php:php:0.5:::::::* cpe:2.3:a:php:php:0.4:::::::* cpe:2.3:a:php:php:0.3:::::::* cpe:2.3:a:php:php:0.2.4:::::::* cpe:2.3:a:php:php:0.2.3:::::::* cpe:2.3:a:php:php:0.2.2:::::::* cpe:2.3:a:php:php:0.2.1:::::::* cpe:2.3:a:php:php:0.2.0:::::::* cpe:2.3:a:php:php:0.2:::::::* cpe:2.3:a:php:php:0.11:::::::* cpe:2.3:a:php:php:0.10:::::::* cpe:2.3:a:php:php:0.1.1:::::::* cpe:2.3:a:php:php:0.1:::::::* cpe:2.3:a:php:php:::::::: cpe:2.3:a:php:php:-:::::::*	195
Hardware	Avaya Converged Communications Server cpe:2.3:h:avaya:converged_communications_server:2.0:::::::*	1
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:3.0:::::::*	1
Os	Hp Hp-Ux cpe:2.3:o:hp:hp-ux:b.11.23:::::::* cpe:2.3:o:hp:hp-ux:b.11.22:::::::* cpe:2.3:o:hp:hp-ux:b.11.11:::::::* cpe:2.3:o:hp:hp-ux:b.11.00:::::::*	4
Os	Trustix Secure Linux cpe:2.3:o:trustix:secure_linux:2.1:::::::* cpe:2.3:o:trustix:secure_linux:2.0:::::::* cpe:2.3:o:trustix:secure_linux:1.5:::::::*	3

OpenVAS Exploits

Date	Description
2009-05-05	Name : HP-UX Update for Apache HPSBUX01064 File : nvt/gb_hp_ux_HPSBUX01064.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200407-13 (PHP) File : nvt/glsa_200407_13.nasl
2008-09-04	Name : php -- memory_limit related vulnerability File : nvt/freebsd_mod_php4-twig3.nasl
2008-01-17	Name : Debian Security Advisory DSA 531-1 (php4) File : nvt/deb_531_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 532-2 (libapache-mod-ssl) File : nvt/deb_532_2.nasl
2008-01-17	Name : Debian Security Advisory DSA 669-1 (php3) File : nvt/deb_669_1.nasl
2005-11-03	Name : php < 4.3.8 File : nvt/php_strip_tags_memory_limit_vuln.nasl
0000-00-00	Name : Slackware Advisory SSA:2004-202-01 PHP File : nvt/esoft_slk_ssa_2004_202_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
7870	PHP memory_limit Function Arbitrary Code Execution The PHP memory_limit function contains a flaw that may allow a malicious user to remotely execute arbitrary code. The issue is triggered when an attacker is able to trigger the memory_limit abort within the zend_hash_init() function. It is possible that the flaw may allow the attacker to control the heap, resulting in a loss of confidentiality, integrity, and/or availability.

Description

7870

PHP memory_limit Function Arbitrary Code Execution

The PHP memory_limit function contains a flaw that may allow a malicious user to remotely execute arbitrary code. The issue is triggered when an attacker is able to trigger the memory_limit abort within the zend_hash_init() function. It is possible that the flaw may allow the attacker to control the heap, resulting in a loss of confidentiality, integrity, and/or availability.

Snort® IPS/IDS

Date	Description
2014-01-10	PHP memory_limit vulnerability exploit attempt RuleID : 16078 - Revision : 6 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date	Description
2005-07-13	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-202-01.nasl - Type : ACT_GATHER_INFO
2005-07-13	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_dd7aa4f1102f11d98a8a000c41e2cdad.nasl - Type : ACT_GATHER_INFO
2005-02-10	Name : The remote Debian host is missing a security-related update. File : debian_DSA-669.nasl - Type : ACT_GATHER_INFO
2005-01-26	Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd2005-001.nasl - Type : ACT_GATHER_INFO
2004-09-29	Name : The remote Debian host is missing a security-related update. File : debian_DSA-531.nasl - Type : ACT_GATHER_INFO
2004-08-30	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200407-13.nasl - Type : ACT_GATHER_INFO
2004-07-31	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-068.nasl - Type : ACT_GATHER_INFO
2004-07-25	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2004_021.nasl - Type : ACT_GATHER_INFO
2004-07-24	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-222.nasl - Type : ACT_GATHER_INFO
2004-07-24	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-223.nasl - Type : ACT_GATHER_INFO
2004-07-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-392.nasl - Type : ACT_GATHER_INFO
2004-07-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-395.nasl - Type : ACT_GATHER_INFO
2004-07-15	Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_strip_tags_memory_limit_vuln.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/10725
BUGTRAQ	http://marc.info/?l=bugtraq&m=108981780109154&w=2 http://marc.info/?l=bugtraq&m=108982983426031&w=2 http://marc.info/?l=bugtraq&m=109051444105182&w=2
CONECTIVA	http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000847
DEBIAN	http://www.debian.org/security/2004/dsa-531 http://www.debian.org/security/2005/dsa-669
FULLDISC	http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023908.html
GENTOO	http://www.gentoo.org/security/en/glsa/glsa-200407-13.xml
HP	http://marc.info/?l=bugtraq&m=109181600614477&w=2
MANDRAKE	http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:068
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2004-392.html http://www.redhat.com/support/errata/RHSA-2004-395.html http://www.redhat.com/support/errata/RHSA-2004-405.html http://www.redhat.com/support/errata/RHSA-2005-816.html
SUSE	http://www.novell.com/linux/security/advisories/2004_21_php4.html
TRUSTIX	http://www.trustix.org/errata/2004/0039/
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/16693

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-02-16 05:28:27	Multiple Updates
2024-02-02 01:02:34	Multiple Updates
2024-02-01 12:01:32	Multiple Updates
2023-09-05 12:02:27	Multiple Updates
2023-09-05 01:01:23	Multiple Updates
2023-09-02 12:02:28	Multiple Updates
2023-09-02 01:01:23	Multiple Updates
2023-08-12 12:02:59	Multiple Updates
2023-08-12 01:01:23	Multiple Updates
2023-08-11 12:02:34	Multiple Updates
2023-08-11 01:01:25	Multiple Updates
2023-08-06 12:02:22	Multiple Updates
2023-08-06 01:01:24	Multiple Updates
2023-08-04 12:02:26	Multiple Updates
2023-08-04 01:01:25	Multiple Updates
2023-07-14 12:02:25	Multiple Updates
2023-07-14 01:01:25	Multiple Updates
2023-03-29 01:02:26	Multiple Updates
2023-03-28 12:01:30	Multiple Updates
2022-10-11 12:02:09	Multiple Updates
2022-10-11 01:01:17	Multiple Updates
2021-05-04 12:02:21	Multiple Updates
2021-04-22 01:02:30	Multiple Updates
2020-05-23 00:15:49	Multiple Updates
2019-06-08 12:01:18	Multiple Updates
2018-10-31 00:19:43	Multiple Updates
2017-10-11 09:23:22	Multiple Updates
2017-07-11 12:01:28	Multiple Updates
2016-10-18 12:01:21	Multiple Updates
2016-06-28 15:05:58	Multiple Updates
2016-04-26 12:51:19	Multiple Updates
2014-02-17 10:27:43	Multiple Updates
2014-01-19 21:22:14	Multiple Updates
2013-05-11 11:42:06	Multiple Updates

Global Informations

Type	Count
Capec ID(s)	2
CWE ID(s)	2
Oval ID(s)	1
CPE ID(s)	206
Sources(s)	19
osvdb(s)	1
Openvas Exploit(s)	8
Snort® Rule(s)	1
Nessus® Exploit(s)	13

	Related
6.8	RHSA-2004:395
6.8	RHSA-2004:392
6.8	DSA-669
6.8	DSA-531
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)