icon customer loginCustomer Area icon helpNeed help?
icon CSI downloadTry CSI icon PSI downloadDownload PSI icon Scan now Scan Now

Secunia Advisory SA10818

PHP Configuration Leakage Vulnerability
Secunia Advisory SA10818
DOWNLOAD CSI

DOWNLOAD PSI
Release Date 2004-02-09
Last Update 2005-03-02
   
Popularity 11,330 views
Comments 0 comments

Criticality level Less criticalLess critical
Impact Security Bypass
Exposure of sensitive information
Where From remote
Authentication level Available in Customer Area
   
Report reliability Available in Customer Area
Solution Status Vendor Patch
   
Systems affected Available in Customer Area
Approve distribution Available in Customer Area
Remediation status Secunia CSI, Secunia PSI
Automated scanning Secunia CSI, Secunia PSI
   
Software:
PHP 4.3.x
Secunia CVSS Score Available in Customer Area
CVE Reference(s) No CVE references.
  

Description
A vulnerability has been identified in PHP, potentially allowing malicious people to view sensitive data or bypass an administrative restriction.

The problem arises on systems serving multiple virtual hosts using the Apache web server. Administratively configured settings from one virtual host may be applied (leaked) to other virtual hosts if the same Apache child process is used to access the different virtual hosts.

This can reportedly be exploited to view the source of PHP files, overwrite "register_globals" settings and more. Other vulnerabilities may potentially also be exploited via this issue.

The vulnerability has been reported in PHP version 4.3.4 and prior.

Solution
The vulnerability has been fixed in PHP 4.3.5 and later.
Further details available in Customer Area

Provided and/or discovered by
Reported by multiple individuals (see the original bug reports for details).

Changelog
Further details available in Customer Area

Original Advisory
http://bugs.php.net/bug.php?id=25753

Deep Links
Links available in Customer Area


Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com
Subject: PHP Configuration Leakage Vulnerability
 
No posts yet

-

You must be logged in to post a comment.


footer
© 2002-2010 Secunia ApS • Weidekampsgade 14A, Copenhagen, Denmark • +45 7020 5144 • Contact Us
Terms & Conditions and Copyright • Report vulnerability
CVE logo OTA logo First logo