Lucene search

MitreCVE-2003-1307

HistoryOct 23, 2006 - 5:00 p.m.

CVE-2003-1307

2006-10-2317:00:00

mitre

web.nvd.nist.gov

cve-2003-1307

apache http server

mod_php

local users

signals

intercept connections

vulnerability

nvd

CVSS2

4.3

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server’s process group and use the server’s file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server’s TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them … Not a bug in PHP.

Affected configurations

Nvd

Node

apachehttp_serverMatch2.0

apachehttp_serverMatch2.0.9

apachehttp_serverMatch2.0.28

apachehttp_serverMatch2.0.28beta

apachehttp_serverMatch2.0.28betawin32

apachehttp_serverMatch2.0.32

apachehttp_serverMatch2.0.32betawin32

apachehttp_serverMatch2.0.34betawin32

apachehttp_serverMatch2.0.35

apachehttp_serverMatch2.0.36

apachehttp_serverMatch2.0.37

apachehttp_serverMatch2.0.38

apachehttp_serverMatch2.0.39

apachehttp_serverMatch2.0.40

apachehttp_serverMatch2.0.41

apachehttp_serverMatch2.0.42

apachehttp_serverMatch2.0.43

apachehttp_serverMatch2.0.44

apachehttp_serverMatch2.0.45

apachehttp_serverMatch2.0.46

apachehttp_serverMatch2.0.46win32

apachehttp_serverMatch2.0.47

apachehttp_serverMatch2.0.48

VendorProductVersionCPE
apachehttp_server2.0cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*
apachehttp_server2.0.9cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*
apachehttp_server2.0.28cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*
apachehttp_server2.0.28cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*
apachehttp_server2.0.28cpe:2.3:a:apache:http_server:2.0.28:beta:win32:*:*:*:*:*
apachehttp_server2.0.32cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*
apachehttp_server2.0.32cpe:2.3:a:apache:http_server:2.0.32:beta:win32:*:*:*:*:*
apachehttp_server2.0.34cpe:2.3:a:apache:http_server:2.0.34:beta:win32:*:*:*:*:*
apachehttp_server2.0.35cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
apachehttp_server2.0.36cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	http_server	2.0	cpe:2.3:a:apache:http_server:2.0:::::::*
apache	http_server	2.0.9	cpe:2.3:a:apache:http_server:2.0.9:::::::*
apache	http_server	2.0.28	cpe:2.3:a:apache:http_server:2.0.28:::::::*
apache	http_server	2.0.28	cpe:2.3:a:apache:http_server:2.0.28:beta::::::
apache	http_server	2.0.28	cpe:2.3:a:apache:http_server:2.0.28:beta:win32:::::*
apache	http_server	2.0.32	cpe:2.3:a:apache:http_server:2.0.32:::::::*
apache	http_server	2.0.32	cpe:2.3:a:apache:http_server:2.0.32:beta:win32:::::*
apache	http_server	2.0.34	cpe:2.3:a:apache:http_server:2.0.34:beta:win32:::::*
apache	http_server	2.0.35	cpe:2.3:a:apache:http_server:2.0.35:::::::*
apache	http_server	2.0.36	cpe:2.3:a:apache:http_server:2.0.36:::::::*

Rows per page:

1-10 of 231

References

bugs.php.net/38915

hackerdom.ru/~dimmo/phpexpl.c

www.securityfocus.com/archive/1/348368

www.securityfocus.com/archive/1/449234/100/0/threaded

www.securityfocus.com/archive/1/449298/100/0/threaded

www.securityfocus.com/bid/9302

CVSS2

4.3

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Related for CVE-2003-1307