CVE-2008-3659: Buffer Overflow

Published Aug 15, 2008

Updated

Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safemode are feasible.

Affected Software

16 affected components

PHP PHP=4.4.4

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=4.4.2

PHP PHP=5.2.6

PHP PHP=4.4.3

PHP PHP=5.2.3

PHP PHP=4.4.5

PHP PHP=4.4.8

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=4.4.0

PHP PHP=4.4.6

PHP PHP=4.4.1

PHP PHP=5.2.1

PHP PHP=4.4.7

Remediation

Patch Available

http://www.php.net/archive/2008.php#id2008-08-07-1

Event History

Aug 15, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3659?

CVE-2008-3659 is considered a medium severity vulnerability due to its potential for causing denial of service and arbitrary code execution.

How do I fix CVE-2008-3659?

To fix CVE-2008-3659, upgrade PHP to version 4.4.9 or later, or 5.2.7 or later.

Which versions of PHP are affected by CVE-2008-3659?

CVE-2008-3659 affects PHP versions 4.4.x before 4.4.9 and 5.2.0 through 5.2.6.

What type of attack can exploit CVE-2008-3659?

CVE-2008-3659 can be exploited by context-dependent attackers to cause a denial of service or potentially execute arbitrary code.

Is there a workaround for CVE-2008-3659?

There is no specific workaround for CVE-2008-3659; the recommended action is to upgrade to a patched version of PHP.