Vulnerability Name:

CVE-2001-1385 (CCN-5939)

Assigned:2001-01-12
Published:2001-01-12
Updated:2016-10-18
Summary:The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: CCN
Type: BugTraq Mailing List, Fri Jan 12 2001 - 13:14:10 CST
PHP Security Advisory - Apache Module bugs

Source: MITRE
Type: CNA
CVE-2001-1385

Source: CONECTIVA
Type: UNKNOWN
CLA-2001:373

Source: CCN
Type: Conectiva Linux Announcement CLSA-2001:373
php4

Source: BUGTRAQ
Type: UNKNOWN
20010112 PHP Security Advisory - Apache Module bugs

Source: CCN
Type: RHSA-2000-136
Updated PHP packages available for Red Hat Linux 5.2

Source: DEBIAN
Type: UNKNOWN
DSA-020

Source: DEBIAN
Type: DSA-020
php4 -- remote DOS and remote information leak

Source: XF
Type: Patch, Vendor Advisory
php-view-source-code(5939)

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2001:013

Source: CCN
Type: OSVDB ID: 5425
PHP mod_php Virtual Host Source Code Exposure

Source: CCN
Type: PHP Downloads Web site
Downloads

Source: REDHAT
Type: Patch
RHSA-2000:136

Source: BID
Type: UNKNOWN
2205

Source: CCN
Type: BID-2205
PHP Engine Disable Source Viewing Vulnerability

Source: CCN
Type: MandrakeSoft Security Advisory MDKSA-2001:013
php

Source: XF
Type: UNKNOWN
php-view-source-code(5939)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:php:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.4:-:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:php:php:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:rc2:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:linux:5.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:6.2:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    php php 4.0
    php php 4.0.1
    php php 4.0.3
    php php 4.0.4
    mandrakesoft mandrake linux 7.2
    php php 4.0.0
    php php 4.0.1 -
    php php 4.0.2
    php php 4.0.3
    php php 4.0.4 -
    php php 4.0 beta_4_patch1
    php php 4.0 beta1
    php php 4.0 beta2
    php php 4.0 beta3
    php php 4.0 beta4
    php php 4.0 rc1
    php php 4.0 rc2
    redhat linux 5.2
    redhat linux 6.0
    redhat linux 6.2
    debian debian linux 2.2
    redhat linux 7
    mandrakesoft mandrake linux 7.2
    conectiva linux 6.0
    redhat linux 7.1
    redhat linux 7.2
    redhat linux 7.3