CVE-2004-0594: Medium severity Avaya Converged Communications Server vulnerability

Q: What is the severity of CVE-2004-0594?

CVE-2004-0594 is considered a critical vulnerability due to the potential for remote code execution.

Q: How do I fix CVE-2004-0594?

To fix CVE-2004-0594, update PHP to version 5.0.0 or later and ensure that register_globals is disabled.

Q: Which PHP versions are affected by CVE-2004-0594?

CVE-2004-0594 affects PHP versions 4.x up to 4.3.7 and 5.x up to 5.0.0 RC3.

Q: Can CVE-2004-0594 be exploited remotely?

Yes, CVE-2004-0594 allows remote attackers to execute arbitrary code under certain conditions.

Q: What impact can CVE-2004-0594 have on my system?

Exploiting CVE-2004-0594 can lead to full system compromise, allowing attackers to take control of the affected server.

Published Jul 16, 2004

Updated

The memorylimit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when registerglobals is enabled, allows remote attackers to execute arbitrary code by triggering a memorylimit abort during execution of the zendhashinit function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

Affected Software

78 affected components

Avaya Converged Communications Server=2.0

redhat Fedora Core=core_1.0

redhat Fedora Core=core_2.0

Trustix Secure Linux=1.5

Trustix Secure Linux=2.0

Trustix Secure Linux=2.1

Avaya Integrated Management

PHP PHP=3.0

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=3.0.3

PHP PHP=3.0.4

PHP PHP=3.0.5

PHP PHP=3.0.6

PHP PHP=3.0.7

PHP PHP=3.0.8

PHP PHP=3.0.9

PHP PHP=3.0.10

PHP PHP=3.0.11

PHP PHP=3.0.12

PHP PHP=3.0.13

PHP PHP=3.0.14

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=3.0.17

PHP PHP=3.0.18

PHP PHP=4.0

PHP PHP=4.0.1

PHP PHP=4.0.1-patch1

PHP PHP=4.0.1-patch2

PHP PHP=4.0.2

PHP PHP=4.0.3

PHP PHP=4.0.3-patch1

PHP PHP=4.0.4

PHP PHP=4.0.5

PHP PHP=4.0.6

PHP PHP=4.0.7

PHP PHP=4.0.7-rc1

PHP PHP=4.0.7-rc2

PHP PHP=4.0.7-rc3

PHP PHP=4.1.0

PHP PHP=4.1.1

PHP PHP=4.1.2

PHP PHP=4.2

PHP PHP=4.2.0

PHP PHP=4.2.1

PHP PHP=4.2.2

PHP PHP=4.2.3

PHP PHP=4.3.0

PHP PHP=4.3.1

PHP PHP=4.3.2

PHP PHP=4.3.3

PHP PHP=4.3.5

PHP PHP=4.3.6

PHP PHP=4.3.7

PHP PHP=5.0-rc1

PHP PHP=5.0-rc2

PHP PHP=5.0-rc3

Avaya S8300=r2.0.0

Avaya S8300=r2.0.1

Avaya S8500=r2.0.0

Avaya S8500=r2.0.1

Avaya S8700=r2.0.0

Avaya S8700=r2.0.1

Openpkg Openpkg=2.0

Openpkg Openpkg=2.1

Debian Debian Linux=3.0

HP HP-UX=b.11.00

HP HP-UX=b.11.11

HP HP-UX=b.11.22

HP HP-UX=b.11.23

PHP PHP>=4.0<4.3.7

PHP PHP=5.0.0-beta1

PHP PHP=5.0.0-beta2

PHP PHP=5.0.0-beta3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0-rc1

PHP PHP=5.0.0-rc2

Event History

Jul 16, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-0594?

CVE-2004-0594 is considered a critical vulnerability due to the potential for remote code execution.

How do I fix CVE-2004-0594?

To fix CVE-2004-0594, update PHP to version 5.0.0 or later and ensure that register_globals is disabled.

Which PHP versions are affected by CVE-2004-0594?