CVE-2003-0097: High severity PHP PHP vulnerability
Unknown vulnerability in CGI module for PHP 4.3.0 allows attackers to access arbitrary files as the PHP user, and possibly execute PHP code, by bypassing the CGI force redirect settings (cgi.forceredirect or --enable-force-cgi-redirect).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable cgi.force_redirect in php.ini (set cgi.force_redirect to enabled/On/1 as appropriate) and restart the web server to enforce CGI force redirect.
PHP CGI module cgi.force_redirect = enabled - Configuration
Rebuild or reconfigure PHP with the --enable-force-cgi-redirect configure option enabled (i.e., configure PHP using --enable-force-cgi-redirect) and restart the web server.
PHP build configuration --enable-force-cgi-redirect = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0097?
CVE-2003-0097 is considered to be a critical vulnerability due to the potential remote file access and execution of arbitrary code.
How do I fix CVE-2003-0097?
To fix CVE-2003-0097, update to a later version of PHP that has resolved this vulnerability.
What software is affected by CVE-2003-0097?
CVE-2003-0097 specifically affects PHP version 4.3.0.
What kind of attacks can exploit CVE-2003-0097?
CVE-2003-0097 can be exploited by attackers to read arbitrary files and potentially execute PHP code on the server.
How can I determine if my system is vulnerable to CVE-2003-0097?
To determine if your system is vulnerable to CVE-2003-0097, check if you are running PHP version 4.3.0 without appropriate security measures.