CVE-2000-0059: Critical severity PHP PHP vulnerability

Published Jan 4, 2000

Updated

PHP3 with safemode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.

Affected Software

14 affected components

PHP PHP=3.0

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=3.0.8

PHP PHP=3.0.13

PHP PHP=3.0.7

PHP PHP=3.0.6

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=3.0.12

PHP PHP=3.0.9

PHP PHP=3.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable safe_mode in php.ini (set safe_mode = Off) because PHP3 with safe_mode enabled does not properly filter shell metacharacters for commands executed by popen.
PHP (php.ini) safe_mode = Off
Configuration
Prevent use of popen by adding it to disable_functions in php.ini (e.g., add 'popen') to avoid execution of shell commands via popen.
PHP (php.ini) disable_functions = include popen

Event History

Jan 4, 2000

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Feb 4, 2000

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0059?

CVE-2000-0059 has a high severity rating due to its potential to allow remote command execution.

How do I fix CVE-2000-0059?

To mitigate CVE-2000-0059, upgrade PHP to a version newer than 3.0.13 where the issue is resolved.

What versions of PHP are affected by CVE-2000-0059?

PHP versions 3.0 through 3.0.13 are affected by CVE-2000-0059.

Is CVE-2000-0059 related to safe_mode in PHP?

Yes, CVE-2000-0059 specifically involves PHP's safe_mode failing to filter shell metacharacters.

Can CVE-2000-0059 be exploited remotely?

Yes, CVE-2000-0059 can be exploited by remote attackers to execute unauthorized commands.