CVE-2008-2666: Path Traversal

Q: What is the severity of CVE-2008-2666?

CVE-2008-2666 is considered to have a moderate severity level due to its potential to allow attackers to bypass safe_mode restrictions.

Q: How do I fix CVE-2008-2666?

To fix CVE-2008-2666, upgrade to PHP version 5.2.7 or later, which resolves the directory traversal vulnerabilities.

Q: What versions of PHP are affected by CVE-2008-2666?

CVE-2008-2666 affects PHP versions up to and including 5.2.6.

Q: What attacks does CVE-2008-2666 enable?

CVE-2008-2666 enables context-dependent attackers to perform directory traversal attacks that bypass safe_mode restrictions.

Q: Is CVE-2008-2666 related to all PHP 5.x versions?

CVE-2008-2666 specifically affects PHP versions from 5.0.0 up to 5.2.6, including all 5.1.x and 5.2.x subversions.

Published Jun 20, 2008

Updated

Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safemode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.

Affected Software

23 affected components

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=5.1.1

PHP PHP=5.1.6

PHP PHP=5.0-rc1

PHP PHP=5.2.2

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=5.0.4

PHP PHP=5.0-rc3

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=5.2.4

PHP PHP=5.1.3

PHP PHP=5.0.2

PHP PHP<=5.2.6

PHP PHP=5.2.1

PHP PHP=5.0.0

Event History

Jun 20, 2008

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2666?

CVE-2008-2666 is considered to have a moderate severity level due to its potential to allow attackers to bypass safe_mode restrictions.

How do I fix CVE-2008-2666?

To fix CVE-2008-2666, upgrade to PHP version 5.2.7 or later, which resolves the directory traversal vulnerabilities.

What versions of PHP are affected by CVE-2008-2666?