CVE-2005-3319: Low severity PHP PHP vulnerability

Published Oct 27, 2005

Updated

The apache2handler SAPI (sapiapache2.c) in the Apache module (modphp) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.savepath option in a .htaccess file or VirtualHost.

Affected Software

44 affected components

PHP PHP=4.3.9

PHP PHP=4.2.0

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=5.0.1

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=5.0.3

PHP PHP=4.2.3

PHP PHP=4.0.1-patch1

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=4.0.7-rc3

PHP PHP=4.3.1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=4.2

PHP PHP=4.0.3

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

Event History

Oct 27, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-3319?

CVE-2005-3319 is classified as a denial of service vulnerability that can cause a segmentation fault in affected PHP versions.

How do I fix CVE-2005-3319?

To mitigate CVE-2005-3319, upgrade PHP to versions 5.1.0 or later, or 4.4.1 or later.

Which PHP versions are affected by CVE-2005-3319?

CVE-2005-3319 affects PHP versions 4.0.0 through 4.4.0 and 5.0.0 through 5.0.5.

What causes CVE-2005-3319?

CVE-2005-3319 is triggered by the session.save_path option being incorrectly configured in a .htaccess file or VirtualHost.

Can CVE-2005-3319 be exploited remotely?

Yes, CVE-2005-3319 can be exploited remotely by attackers with the ability to set or manipulate the session.save_path.