CVE-2009-3294

The popen API function in TSRM/tsrmwin32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service crash via a crafted 1 "e" or 2 "er" string in the second argument aka mode, possibly related t...

CVE-2009-3294

The popen API function in TSRM/tsrmwin32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service crash via a crafted 1 "e" or 2 "er" string in the second argument aka mode, possibly related t...

CVE-2009-3294

The popen API function in TSRM/tsrmwin32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service crash via a crafted 1 "e" or 2 "er" string in the second argument aka mode, possibly related t...

CVE-2009-3294

CVE-2009-3294 affects PHP prior to 5.2.11 and 5.3.x prior to 5.3.1. The vulnerability is in the popen API (TSRM/tsrm_win32.c) on certain Windows OSes, where a crafted second argument (mode) of either "e" or "er" can cause a denial of service (crash) and may involve the Microsoft C runtime’s _fdop...

CVE-2009-3294: Use of Externally-Controlled Format String

The popen API function in TSRM/tsrmwin32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service crash via a crafted 1 "e" or 2 "er" string in the second argument aka mode, possibly related t...

PT-2009-5607 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.2.11 PHP versions 5.3.x prior to 5.3.1 Description: The issue allows context-dependent attackers to cause a denial of service crash via a crafted 1 "e" or 2 "er" string in the second argument aka mode of the popen API...

php5 -- Multiple security issues

Vendor reports Security Enhancements and Fixes in PHP 5.2.11: Fixed certificate validation inside phpopensslapplyverificationpolicy. Fixed sanity check for the color index in imagecolortransparent. Added missing sanity checks around exif processing. Fixed bug 44683 popen crashes when an invalid...

Information disclosure

PHP 5.2.5 does not enforce a openbasedir and b safemodeexecdir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the 1 exec, 2 system, 3 shellexec, 4 passthru, or 5 popen functions,...

PHP多个函数绕过safe_mode安全限制漏洞

BUGTRAQ ID: 35435 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 在安全模式下，PHP没有禁用exec、system、passthru和popen这四个函数，只是在 safemodeexecdir目录下执行。但当safemode=on且safemodeexecdir为空时（默认），PHP在处理这一过程中存在安全隐患，在windows下exec/system/passthru可以通过引入“\”来执行程序。 以exec函数为例分析源码： // exec.c PHPFUNCTIONexec...

PHP popen()函数缓冲区溢出漏洞

BUGTRAQ ID: 33216 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的Popen函数用创建管道的方式启动进程，并调用shell。在打开管道时Popen函数会fork指定的命令参数： popen string $commandtoexecute , string $mode 如果第二个参数超长的话，就可能触发缓冲区溢出，导致执行任意代码。 PHP PHP 5.2.8 PHP PHP 4.2.1 PHP PHP 4.2.0 厂商补丁： PHP ---...

PHP Buffer Overflow(popen)

Apache 2.2.11/PHP 5.2.8 Buffer Overflow Exploit popen func Type: Remote and Local Requirements for exploit: popen enabled. By: e.wiZz! Enes Muљi [email protected] PHP Popen function overview: Popen function in php opens a pipe to a process executed by forking the command given by command. It was...

PHP popen() function buffer overflow

Buffer overflow on oversized mode argument...

PHP 5.2.8 - popen() Function Buffer Overflow

PHP 5.2.8 - popen Function Buffer Overflow source: https://www.securityfocus.com/bid/33216/info PHP is prone to a buffer-overflow vulnerability because it fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffers. An attacker can exploit this issue ...

netatalk -- arbitrary command execution in papd daemon

Secunia reports: A vulnerability has been reported in Netatalk, which potentially can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to the papd daemon improperly sanitising several received parameters before passing them in a call to popen. Thi...

Zabbix 1.1.41.4.2 - daemon_start Local Privilege Escalation

Zabbix 1.1.41.4.2 - daemonstart Local Privilege Escalation include include include include int main struct passwd pw; pw = getpwnam"abi"; FILE pipe; char buf25; setgidpw-pwgid; setuidpw-pwuid; printf"my gid: %d\n", getegid; printf"my uid: %d\n", getuid; pipe = popen"/usr/bin/id", "r"; while...

ClamAV: Multiple vulnerabilities

Background Clam AntiVirus is an open source GPL anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Description Nikolaos Rangos discovered a vulnerability in ClamAV which exists because the recipient address extracted from email messages is not properly sanitize...

ClamAV milter popen command injection

Added: 09/06/2007 CVE: CVE-2007-4560 BID: 25439 OSVDB: 36909 Background ClamAV is an open-source anti-virus toolkit. clamav-milter is a derivative of ClamAV for e-mail servers running Sendmail. Problem An insecure call to the popen function in clamav-milter, when running in black hole mode, allow...

ClamAV milter popen command injection

Added: 09/06/2007 CVE: CVE-2007-4560 BID: 25439 OSVDB: 36909 Background ClamAV is an open-source anti-virus toolkit. clamav-milter is a derivative of ClamAV for e-mail servers running Sendmail. Problem An insecure call to the popen function in clamav-milter, when running in black hole mode, allow...

Mandrake Linux Security Advisory : clamav (MDKSA-2007:172)

A vulnerability in ClamAV was discovered that could allow remote attackers to cause a denial of service via a crafted RTF file or a crafted HTML document with a data: URI, both of which trigger a NULL dereference CVE-2007-4510. A vulnerability in clamav-milter, when run in black hole mode, could...

CVE-2007-4560: Improper Neutralization of Special Elements used in an OS Command

clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."...