Vulnerability Name:

CVE-2007-4850 (CCN-39852)

Assigned:2007-09-12
Published:2008-01-22
Updated:2018-10-15
Summary:curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-264
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2007-4850

Source: CCN
Type: PHP CVS Repository
[cvs] Index of /php-src/ext/curl

Source: CONFIRM
Type: Exploit
http://cvs.php.net/viewcvs.cgi/php-src/NEWS?revision=1.2027.2.547.2.1047&view=markup

Source: APPLE
Type: UNKNOWN
APPLE-SA-2008-07-31

Source: APPLE
Type: UNKNOWN
APPLE-SA-2008-10-09

Source: FULLDISC
Type: Exploit
20080122 PHP 5.2.5 cURL safe_mode bypass

Source: CCN
Type: Full-Disclosure Mailing List, Tue, 22 Jan 2008 23:51:19 +0100
PHP 5.2.5 cURL safe_mode bypass

Source: CCN
Type: SA30048
PHP Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
30048

Source: SECUNIA
Type: UNKNOWN
30411

Source: SECUNIA
Type: UNKNOWN
31200

Source: CCN
Type: SA31326
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
31326

Source: CCN
Type: SA32222
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
32222

Source: SREASONRES
Type: Exploit
20080122 PHP 5.2.5 cURL safe_mode bypass

Source: SREASON
Type: UNKNOWN
3562

Source: CCN
Type: Apple Web site
About Security Update 2008-005

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT3216

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2009:022

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2009:023

Source: MLIST
Type: UNKNOWN
[oss-security] 20080502 CVE Request (PHP)

Source: CCN
Type: OSVDB ID: 43219
PHP cURL Library (libcurl) curl/interface.c Crafted file:// Request Restriction Bypass

Source: CONFIRM
Type: UNKNOWN
http://www.php.net/ChangeLog-5.php

Source: BUGTRAQ
Type: UNKNOWN
20080122 PHP 5.2.5 cURL safe_mode bypass

Source: BUGTRAQ
Type: UNKNOWN
20080527 rPSA-2008-0178-1 php php-mysql php-pgsql

Source: BID
Type: UNKNOWN
27413

Source: CCN
Type: BID-27413
PHP cURL 'safe mode' Security Bypass Vulnerability

Source: BID
Type: UNKNOWN
29009

Source: CCN
Type: BID-29009
PHP 5.2.5 and Prior Versions Multiple Vulnerabilities

Source: BID
Type: UNKNOWN
31681

Source: CCN
Type: BID-31681
RETIRED: Apple Mac OS X 2008-007 Multiple Security Vulnerabilities

Source: CCN
Type: TLSA-2009-2
Multiple vulnerabilities exist in php

Source: CCN
Type: USN-628-1
PHP vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-628-1

Source: VUPEN
Type: UNKNOWN
ADV-2008-1412

Source: VUPEN
Type: UNKNOWN
ADV-2008-2268

Source: VUPEN
Type: UNKNOWN
ADV-2008-2780

Source: XF
Type: UNKNOWN
php-curlinit-security-bypass(39852)

Source: XF
Type: UNKNOWN
php-curlinit-security-bypass(39852)

Source: XF
Type: UNKNOWN
php-safemode-directive-security-bypass(42134)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:php:5.2.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.5:-:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:php:php:5.0.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.5:-:*:*:*:*:*:*
  • AND
  • cpe:/o:apple:mac_os_x:10.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.6:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.6:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06:*:lts:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.7:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.7:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:x86_64:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.8:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.8:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:fuji:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:personal:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:multimedia:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.9:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.9:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:x86-64:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:8.04:*:lts:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.4:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:17737
    P
    		USN-628-1 -- php5 vulnerabilities
    2014-06-30
    BACK
    php php 5.2.4
    php php 5.2.5
    php php 5.0.3 -
    php php 5.0.4 -
    php php 5.0.0 -
    php php 5.0.5 -
    php php 5.1.1
    php php 5.1.2 -
    php php 5.1.4
    php php 5.0.2 -
    php php 5.1.6
    php php 5.2.0
    php php 5.2.1 -
    php php 5.2.3 -
    php php 5.0.0 beta1
    php php 5.0.0 beta2
    php php 5.0.0 beta3
    php php 5.0.0 beta4
    php php 5.0.0 rc1
    php php 5.0.0 rc2
    php php 5.0.0 rc3
    php php 5.0.1 -
    php php 5.1.0 -
    php php 5.1.3
    php php 5.1.5 -
    php php 5.2.2 -
    php php 5.2.4 -
    php php 5.2.5 -
    apple mac os x 10.4
    apple mac os x 10.4.1
    apple mac os x server 10.4.1
    apple mac os x server 10.4
    apple mac os x server 10.4.2
    apple mac os x 10.4.2
    apple mac os x 10.4.4
    apple mac os x 10.4.3
    apple mac os x server 10.4.3
    apple mac os x server 10.4.4
    apple mac os x 10.4.5
    apple mac os x server 10.4.5
    apple mac os x 10.4.6
    apple mac os x server 10.4.6
    canonical ubuntu 6.06
    apple mac os x 10.4.7
    apple mac os x server 10.4.7
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    apple mac os x server 10.4.8
    apple mac os x 10.4.8
    turbolinux turbolinux fuji
    turbolinux turbolinux personal *
    turbolinux turbolinux multimedia *
    apple mac os x server 10.4.9
    apple mac os x 10.4.9
    mandrakesoft mandrake linux 2008.0
    canonical ubuntu 7.04
    apple mac os x 10.4.10
    apple mac os x server 10.4.10
    canonical ubuntu 7.10
    mandrakesoft mandrake linux 2008.0
    apple mac os x server 10.5
    apple mac os x 10.4.11
    apple mac os x server 10.4.11
    apple mac os x server 10.5.1
    apple mac os x server 10.5.2
    canonical ubuntu 8.04
    apple mac os x server 10.5.3
    apple mac os x 10.5.4
    apple mac os x server 10.5.4
    apple mac os x server 10.5.5