CVE-2008-7068: Input Validation

Published Aug 25, 2009

Updated

The dbareplace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.

Affected Software

55 affected components

PHP PHP=4.3.9

PHP PHP=4.4.9

PHP PHP=4.0-beta1

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=4.4.4

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=4.3.6

PHP PHP=4.0.7-rc4

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=4.1.1

PHP PHP=5.2.6

PHP PHP=4.4.3

PHP PHP=4.2.3

PHP PHP=4.4.5

PHP PHP=4.0.1-patch1

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=4.4.8

PHP PHP=4.0.6

PHP PHP=4.1.2

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=4.4.6

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=4.4.7

Event History

Aug 25, 2009

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-7068?

The severity of CVE-2008-7068 is classified as a denial of service vulnerability.

How do I fix CVE-2008-7068?

To fix CVE-2008-7068, upgrade PHP to a version that does not contain this vulnerability, preferably a version beyond 5.2.6.

What versions are affected by CVE-2008-7068?

CVE-2008-7068 affects PHP versions 5.2.6 and earlier versions in the 4.x branch.

What impact does CVE-2008-7068 have on my application?

CVE-2008-7068 can lead to file truncation and potential denial of service in applications that allow context-dependent attacks.

Can CVE-2008-7068 be exploited remotely?

CVE-2008-7068 can be exploited by attackers who can modify or add database entries, but it may require specific context to perform an attack.