CVE-2008-5624: High severity PHP PHP vulnerability

Published Dec 17, 2008

Updated

PHP 5 before 5.2.7 does not properly initialize the pageuid and pagegid global variables for use by the SAPI phpgetuid function, which allows context-dependent attackers to bypass safemode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the errorlog variable.

Affected Software

28 affected components

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=5.1.1

PHP PHP=5.0.0-beta1

PHP PHP=5.1.6

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=5.0.4

PHP PHP=5.2.6

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.0.0-rc3

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.0.0-beta3

PHP PHP=5.1.3

PHP PHP=5.0.0-rc1

PHP PHP=5.0.2

PHP PHP=5.2.1

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=5.0.0-beta2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 5.2.7

Event History

Dec 17, 2008

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-5624?

The severity of CVE-2008-5624 is considered medium due to its potential to bypass safe_mode restrictions.

How do I fix CVE-2008-5624?

To fix CVE-2008-5624, upgrade to PHP version 5.2.7 or later, where the vulnerability is addressed.

Which versions of PHP are affected by CVE-2008-5624?

CVE-2008-5624 affects PHP versions 5.0.0 through 5.2.6, prior to version 5.2.7.

What is the main issue caused by CVE-2008-5624?

CVE-2008-5624 allows context-dependent attackers to bypass safe_mode restrictions, which can lead to privilege escalation.

How can I detect if I'm vulnerable to CVE-2008-5624?

You can detect vulnerability to CVE-2008-5624 by checking the PHP version in use and seeing if it is older than 5.2.7.