Executive Summary

Informations
Name CVE-2009-4018 First vendor Publication 2009-11-29
Vendor Cve Last vendor Modification 2018-10-30

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4018

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13706
 
Oval ID: oval:org.mitre.oval:def:13706
Title: USN-862-1 -- php5 vulnerabilities
Description: Maksymilian Arciemowicz discovered that PHP did not properly validate arguments to the dba_replace function. If a script passed untrusted input to the dba_replace function, an attacker could truncate the database. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, and 8.10. It was discovered that PHP�s php_openssl_apply_verification_policy function did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. It was discovered that PHP did not properly handle certain malformed images when being parsed by the Exif module. A remote attacker could exploit this flaw and cause the PHP server to crash, resulting in a denial of service. Grzegorz Stachowiak discovered that PHP did not properly enforce restrictions in the tempnam function. An attacker could exploit this issue to bypass safe_mode restrictions. Grzegorz Stachowiak discovered that PHP did not properly enforce restrictions in the posix_mkfifo function. An attacker could exploit this issue to bypass open_basedir restrictions. Bogdan Calin discovered that PHP did not limit the number of temporary files created when handling multipart/form-data POST requests. A remote attacker could exploit this flaw and cause the PHP server to consume all available resources, resulting in a denial of service. ATTENTION: This update changes previous PHP behaviour by limiting the number of files in a POST request to 50. This may be increased by adding a "max_file_uploads" directive to the php.ini configuration file. It was discovered that PHP did not properly enforce restrictions in the proc_open function. An attacker could exploit this issue to bypass safe_mode_protected_env_vars restrictions and possibly execute arbitrary code with application privileges
Family: unix Class: patch
Reference(s): USN-862-1
CVE-2008-7068
CVE-2009-3291
CVE-2009-3292
CVE-2009-3557
CVE-2009-3558
CVE-2009-4017
CVE-2009-4018
 Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 8.10
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
 Product(s): php5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7256
 
Oval ID: oval:org.mitre.oval:def:7256
Title: HP-UX Running Apache with PHP, Remote Denial of Service (DoS), Unauthorized Access, Privileged Access, Cross Site Scripting (XSS)
Description: The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable.
Family: unix Class: vulnerability
Reference(s): CVE-2009-4018
 Version: 11
Platform(s): HP-UX 11
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 322

ExploitDB Exploits

id Description
2010-03-05 Kolang (proc_open PHP safe mode bypass 4.3.10 - 5.3.0)

OpenVAS Exploits

Date Description
2012-06-21 Name : PHP version smaller than 5.2.11
File : nvt/nopsec_php_5_2_11.nasl
2012-06-21 Name : PHP version smaller than 5.3.1
File : nvt/nopsec_php_5_3_1.nasl
2010-06-23 Name : HP-UX Update for Apache with PHP HPSBUX02543
File : nvt/gb_hp_ux_HPSBUX02543.nasl
2009-12-10 Name : Mandriva Security Advisory MDVSA-2009:324 (php)
File : nvt/mdksa_2009_324.nasl
2009-12-04 Name : PHP Multiple Vulnerabilities Dec-09
File : nvt/gb_php_mult_vuln_dec09.nasl
2009-12-03 Name : Mandriva Security Advisory MDVSA-2009:303 (php)
File : nvt/mdksa_2009_303.nasl
2009-12-03 Name : Ubuntu USN-862-1 (php5)
File : nvt/ubuntu_862_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
60438 PHP ext/standard/proc_open.c proc_open() Function safe_mode_*_env_vars Bypass

Nessus® Vulnerability Scanner

Date Description
2010-09-17 Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_6_2_0_12.nasl - Type : ACT_GATHER_INFO
2010-07-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-303.nasl - Type : ACT_GATHER_INFO
2009-12-08 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-324.nasl - Type : ACT_GATHER_INFO
2009-11-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-304.nasl - Type : ACT_GATHER_INFO
2009-11-30 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-862-1.nasl - Type : ACT_GATHER_INFO
2009-11-20 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_5_3_1.nasl - Type : ACT_GATHER_INFO
2009-09-18 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_5_2_11.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/37138
CONFIRM http://bugs.php.net/bug.php?id=49026
http://svn.php.net/viewvc/?view=revision&revision=286360
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/standard/proc_open...
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/standard/proc_open...
http://www.php.net/ChangeLog-5.php
HP http://marc.info/?l=bugtraq&m=127680701405735&w=2
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2009:303
MLIST http://marc.info/?l=oss-security&m=125886770008678&w=2
http://marc.info/?l=oss-security&m=125897935330618&w=2
http://www.openwall.com/lists/oss-security/2009/11/23/15
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
SECUNIA http://secunia.com/advisories/40262
http://secunia.com/advisories/41480
http://secunia.com/advisories/41490

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
Date Informations
2024-02-02 01:11:57
  • Multiple Updates
2024-02-01 12:03:20
  • Multiple Updates
2023-09-05 12:11:12
  • Multiple Updates
2023-09-05 01:03:11
  • Multiple Updates
2023-09-02 12:11:17
  • Multiple Updates
2023-09-02 01:03:13
  • Multiple Updates
2023-08-12 12:13:16
  • Multiple Updates
2023-08-12 01:03:12
  • Multiple Updates
2023-08-11 12:11:20
  • Multiple Updates
2023-08-11 01:03:20
  • Multiple Updates
2023-08-06 12:10:53
  • Multiple Updates
2023-08-06 01:03:14
  • Multiple Updates
2023-08-04 12:10:59
  • Multiple Updates
2023-08-04 01:03:16
  • Multiple Updates
2023-07-14 12:10:55
  • Multiple Updates
2023-07-14 01:03:14
  • Multiple Updates
2023-03-29 01:12:31
  • Multiple Updates
2023-03-28 12:03:20
  • Multiple Updates
2022-10-11 12:09:44
  • Multiple Updates
2022-10-11 01:03:02
  • Multiple Updates
2021-05-04 12:10:29
  • Multiple Updates
2021-04-22 01:10:56
  • Multiple Updates
2020-05-23 01:41:06
  • Multiple Updates
2020-05-23 00:24:36
  • Multiple Updates
2019-06-08 12:03:00
  • Multiple Updates
2018-10-31 00:20:00
  • Multiple Updates
2018-10-04 12:05:29
  • Multiple Updates
2017-09-19 09:23:30
  • Multiple Updates
2016-10-29 01:00:44
  • Multiple Updates
2016-06-28 17:54:05
  • Multiple Updates
2016-04-26 19:15:58
  • Multiple Updates
2014-02-17 10:52:24
  • Multiple Updates
2013-05-11 00:01:14
  • Multiple Updates