QwikSec

Security Database

CVE

CWE

Training

CVE-2008-5625

Published: Dec 17, 2008

Modified: Aug 7, 2024

PUBLISHED

Description

PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "php_value error_log" entry in a .htaccess file.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_HP

vendor-advisory

x_refsource_HP

20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl

mailing-list

x_refsource_BUGTRAQ

http://wiki.rpath.com/Advisories:rPSA-2009-0035

x_refsource_CONFIRM

vendor-advisory

x_refsource_HP

php-error-safemode-bypass(47314)

vdb-entry

x_refsource_XF

vdb-entry

x_refsource_BID

20081120 PHP 5.2.6 (error_log) safe_mode bypass

third-party-advisory

x_refsource_SREASONRES

vdb-entry

x_refsource_OSVDB

http://www.php.net/ChangeLog-5.php#5.2.7

x_refsource_CONFIRM

vendor-advisory

x_refsource_MANDRIVA

vendor-advisory

x_refsource_HP

20081120 SecurityReason : PHP 5.2.6 (error_log) safe_mode bypass

mailing-list

x_refsource_BUGTRAQ

exploit

x_refsource_EXPLOIT-DB

third-party-advisory

x_refsource_SECUNIA

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.