National Cyber Awareness System

Vulnerability Summary for CVE-2007-4850

Overview

curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (09/30/2009)

We do not consider these to be security issues. For more details see http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: php-curlinit-security-bypass(39852)

Type: Patch Information

Hyperlink:http://xforce.iss.net/xforce/xfdb/39852

External Source: XF

Name: php-safemode-directive-security-bypass(42134)

Hyperlink:http://xforce.iss.net/xforce/xfdb/42134

External Source: VUPEN

Name: ADV-2008-2780

Hyperlink:http://www.vupen.com/english/advisories/2008/2780

External Source: VUPEN

Name: ADV-2008-2268

Hyperlink:http://www.vupen.com/english/advisories/2008/2268

External Source: VUPEN

Name: ADV-2008-1412

Hyperlink:http://www.vupen.com/english/advisories/2008/1412

External Source: UBUNTU

Name: USN-628-1

Hyperlink:http://www.ubuntu.com/usn/usn-628-1

External Source: BID

Name: 31681

Hyperlink:http://www.securityfocus.com/bid/31681

External Source: BID

Name: 27413

Hyperlink:http://www.securityfocus.com/bid/27413

External Source: BUGTRAQ

Name: 20080527 rPSA-2008-0178-1 php php-mysql php-pgsql

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/492671/100/0/threaded

External Source: BUGTRAQ

Name: 20080122 PHP 5.2.5 cURL safe_mode bypass

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486856/100/0/threaded

External Source: MANDRIVA

Name: MDVSA-2009:023

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:023

External Source: MANDRIVA

Name: MDVSA-2009:022

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:022

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3216

Hyperlink:http://support.apple.com/kb/HT3216

External Source: SREASONRES

Name: 20080122 PHP 5.2.5 cURL safe_mode bypass

Hyperlink:http://securityreason.com/achievement_securityalert/51

External Source: SECUNIA

Name: 32222

Hyperlink:http://secunia.com/advisories/32222

External Source: SECUNIA

Name: 31326

Hyperlink:http://secunia.com/advisories/31326

External Source: SECUNIA

Name: 31200

Hyperlink:http://secunia.com/advisories/31200

External Source: SECUNIA

Name: 30411

Hyperlink:http://secunia.com/advisories/30411

External Source: FULLDISC

Name: 20080122 PHP 5.2.5 cURL safe_mode bypass

Hyperlink:http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059849.html

External Source: APPLE

Name: APPLE-SA-2008-10-09

Hyperlink:http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

External Source: APPLE

Name: APPLE-SA-2008-07-31

Hyperlink:http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html

External Source: CONFIRM

Name: http://cvs.php.net/viewcvs.cgi/php-src/NEWS?revision=1.2027.2.547.2.1047&view=markup

Hyperlink:http://cvs.php.net/viewcvs.cgi/php-src/NEWS?revision=1.2027.2.547.2.1047&view=markup

External Source: BID

Name: 29009

Hyperlink:http://www.securityfocus.com/bid/29009

External Source: CONFIRM

Name: http://www.php.net/ChangeLog-5.php

Hyperlink:http://www.php.net/ChangeLog-5.php

External Source: MLIST

Name: [oss-security] 20080502 CVE Request (PHP)

Hyperlink:http://www.openwall.com/lists/oss-security/2008/05/02/2

External Source: SREASON

Name: 3562

Hyperlink:http://securityreason.com/securityalert/3562

External Source: SECUNIA

Name: 30048

Hyperlink:http://secunia.com/advisories/30048