CVE-2010-1130

2010-03-2600:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.032 Low

EPSS

Percentile

91.1%

JSON

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does
not properly interpret ; (semicolon) characters in the argument to the
session_save_path function, which allows context-dependent attackers to
bypass open_basedir and safe_mode restrictions via an argument that
contains multiple ; characters in conjunction with a … (dot dot).

Notes

Author	Note
mdeslaur	actually fixed in 5.3.2 open_basedir and safe_mode issue dapper doesn’t try and strip ; chars, so not vulnerable

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchphp5< 5.2.4-2ubuntu5.12UNKNOWN
ubuntu9.04noarchphp5< 5.2.6.dfsg.1-3ubuntu4.6UNKNOWN
ubuntu9.10noarchphp5< 5.2.10.dfsg.1-2ubuntu6.5UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	php5	< 5.2.4-2ubuntu5.12	UNKNOWN
ubuntu	9.04	noarch	php5	< 5.2.6.dfsg.1-3ubuntu4.6	UNKNOWN
ubuntu	9.10	noarch	php5	< 5.2.10.dfsg.1-2ubuntu6.5	UNKNOWN