CVE-2003-0863: High severity PHP PHP vulnerability
The phpchecksafemodeincludedir function in fopenwrappers.c of PHP 4.3.x returns a success value (0) when the safemodeincludedir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In php.ini, set safe_mode_include_dir to a specific directory path (do not leave it unspecified) so php_check_safe_mode_include_dir does not return success due to an unspecified value.
PHP safe_mode_include_dir = set to a specific directory path (non-empty) - Operational
Audit PHP applications and server configurations for file include/require usage (especially dynamic includes). Identify include sites that could be influenced by remote input and apply input validation, whitelisting, or other hardening to prevent remote file-include exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0863?
CVE-2003-0863 is considered a high severity vulnerability due to its potential to allow remote file inclusion attacks.
How do I fix CVE-2003-0863?
To fix CVE-2003-0863, ensure that the 'safe_mode_include_dir' configuration option is explicitly set in PHP 4.3.x.
Which versions of PHP are affected by CVE-2003-0863?
CVE-2003-0863 affects PHP versions 4.3.0, 4.3.1, and 4.3.2.
What type of vulnerability is CVE-2003-0863?
CVE-2003-0863 is a file inclusion vulnerability that can be exploited due to improper handling of safe mode settings.
Can CVE-2003-0863 be exploited remotely?
Yes, CVE-2003-0863 can be exploited remotely, allowing attackers to include malicious files through PHP scripts.