CVE-2008-0599: Critical severity php vulnerability
Published May 5, 2008
·Updated
The initrequestinfo function in sapi/cgi/cgimain.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATHTRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
Affected Software
34 affected components
PHP PHP=5.1.5
PHP PHP=5.1.2
PHP PHP=5.1.1
PHP PHP=5.0.0-beta1
PHP PHP=5.1.6
PHP PHP=5.2.2
PHP PHP=5.0.5
PHP PHP=5.0.1
PHP PHP=5.1.4
PHP PHP=5.0.4
PHP PHP=5.0.0-rc2
PHP PHP=5.2.3
PHP PHP=5.0.3
PHP PHP=5.1.0
PHP PHP=5.0.0-rc3
PHP PHP<=5.2.5
PHP PHP=5.2.0
PHP PHP=5.2.4
PHP PHP=5.0.0-beta3
PHP PHP=5.1.3
PHP PHP=5.0.0-rc1
PHP PHP=5.0.2
PHP PHP=5.2.1
PHP PHP=5.0.0-beta4
PHP PHP=5.0.0-beta2
PHP PHP<5.2.6
Fedoraproject Fedora=8
Fedoraproject Fedora=9
Canonical Ubuntu Linux=6.06
Canonical Ubuntu Linux=7.04
Canonical Ubuntu Linux=7.10
Canonical Ubuntu Linux=8.04
Apple iOS and macOS<10.5.4
Apple Mac OS X Server<10.5.4
Event History
May 5, 2008
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-0599?
CVE-2008-0599 is rated as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2008-0599?
To mitigate CVE-2008-0599, upgrade your PHP version to 5.2.6 or later.
3
What versions of PHP are affected by CVE-2008-0599?
CVE-2008-0599 affects PHP versions prior to 5.2.6, including 5.1.x and 5.0.x versions.
4
Can CVE-2008-0599 be exploited remotely?
Yes, CVE-2008-0599 can be exploited remotely through crafted URIs.
5
What kind of attack could CVE-2008-0599 facilitate?
CVE-2008-0599 could allow attackers to execute arbitrary code on vulnerable PHP installations.