CVE-2011-2202

Executive Summary

Informations
Name	CVE-2011-2202	First vendor Publication	2011-06-16
Vendor	Cve	Last vendor Modification	2012-11-05

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:P)
Cvss Base Score	6.4	Attack Range	Network
Cvss Impact Score	4.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2202

CWE : Common Weakness Enumeration

id	Name
CWE-264	Permissions, Privileges, and Access Controls

CPE : Common Platform Enumeration

Type	Description	Count
Application	Php Php cpe:/a:php:php:5.3.6 cpe:/a:php:php:5.3.5 cpe:/a:php:php:5.3.4 cpe:/a:php:php:5.3.3 cpe:/a:php:php:5.3.2 cpe:/a:php:php:5.3.1 cpe:/a:php:php:5.3.0 cpe:/a:php:php:4.4.9 cpe:/a:php:php:4.4.8 cpe:/a:php:php:4.4.7 cpe:/a:php:php:4.4.6 cpe:/a:php:php:4.4.5 cpe:/a:php:php:4.4.4 cpe:/a:php:php:4.4.3 cpe:/a:php:php:4.4.2 cpe:/a:php:php:4.4.1 cpe:/a:php:php:4.4.0 cpe:/a:php:php:4.3.9 cpe:/a:php:php:4.3.8 cpe:/a:php:php:4.3.7 cpe:/a:php:php:4.3.6 cpe:/a:php:php:4.3.5 cpe:/a:php:php:4.3.4 cpe:/a:php:php:4.3.3 cpe:/a:php:php:4.3.2 cpe:/a:php:php:4.3.11 cpe:/a:php:php:4.3.10 cpe:/a:php:php:4.3.1 cpe:/a:php:php:4.3.0 cpe:/a:php:php:4.3 cpe:/a:php:php:4.2.4 cpe:/a:php:php:4.2.3 cpe:/a:php:php:4.2.2 cpe:/a:php:php:4.2.1 cpe:/a:php:php:4.2.0 cpe:/a:php:php:4.2 cpe:/a:php:php:4.1.3 cpe:/a:php:php:4.1.2 cpe:/a:php:php:4.1.1 cpe:/a:php:php:4.1.0 cpe:/a:php:php:4.0.7 cpe:/a:php:php:4.0.6 cpe:/a:php:php:4.0.5 cpe:/a:php:php:4.0.4 cpe:/a:php:php:4.0.3 cpe:/a:php:php:4.0.2 cpe:/a:php:php:4.0.1 cpe:/a:php:php:4.0.0 cpe:/a:php:php:4.0:beta4 cpe:/a:php:php:4.0:beta2 cpe:/a:php:php:4.0:beta1 cpe:/a:php:php:4.0 cpe:/a:php:php:4.0:beta_4_patch1 cpe:/a:php:php:4.0:beta3 cpe:/a:php:php:3.0.9 cpe:/a:php:php:3.0.8 cpe:/a:php:php:3.0.7 cpe:/a:php:php:3.0.6 cpe:/a:php:php:3.0.5 cpe:/a:php:php:3.0.4 cpe:/a:php:php:3.0.3 cpe:/a:php:php:3.0.2 cpe:/a:php:php:3.0.18 cpe:/a:php:php:3.0.17 cpe:/a:php:php:3.0.16 cpe:/a:php:php:3.0.15 cpe:/a:php:php:3.0.14 cpe:/a:php:php:3.0.13 cpe:/a:php:php:3.0.12 cpe:/a:php:php:3.0.11 cpe:/a:php:php:3.0.10 cpe:/a:php:php:3.0.1 cpe:/a:php:php:3.0 cpe:/a:php:php:2.0b10 cpe:/a:php:php:2.0 cpe:/a:php:php:1.0	76

Open Source Vulnerability Database (OSVDB)

id	Description
73113	PHP main/rfc1867.c rfc1867_post_handler Function Traversal Upload File Path I...

Internal Sources (Detail)

Source	Url
APPLE	http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
BID	http://www.securityfocus.com/bid/48259 http://www.securityfocus.com/bid/49241
CONFIRM	http://bugs.php.net/bug.php?id=54939 http://support.apple.com/kb/HT5130 http://svn.php.net/viewvc?view=revision&revision=312103 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/rfc1867.c?r1=3121... http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/NEWS?view=markup&p... http://www.php.net/archive/2011.php#id2011-08-18-1 http://www.php.net/ChangeLog-5.php#5.3.7
DEBIAN	http://www.debian.org/security/2011/dsa-2266
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2011:165
MISC	http://pastebin.com/1edSuSVN
MLIST	http://openwall.com/lists/oss-security/2011/06/12/5 http://openwall.com/lists/oss-security/2011/06/13/15
REDHAT	http://rhn.redhat.com/errata/RHSA-2012-0071.html http://www.redhat.com/support/errata/RHSA-2011-1423.html
SECTRACK	http://securitytracker.com/id?1025659
SECUNIA	http://secunia.com/advisories/44874
XF	http://xforce.iss.net/xforce/xfdb/67999

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-10 23:01:31	Multiple Updates

Type	Count
CPE ID(s)	76
osvdb(s)	1

Related	Severity
MDVSA-2012:071	(Critical)
MDVSA-2011:165	(Critical)
HPSBMU02764 SSR...	(Critical)
GLSA-201110-06	(Critical)
USN-1231-1	(High)
RHSA-2012:0033	(High)
RHSA-2011:1423	(High)
HPSBOV02763 SSR...	(High)
DSA-2266	(High)
DSA-2262	(High)
RHSA-2012:0071	(Medium)