CVE-2009-0754: Low severity PHP PHP vulnerability
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.funcoverload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable per-directory .htaccess overrides for virtual hosts by setting AllowOverride None in the Apache configuration (e.g., in the <Directory> or vhost blocks) so .htaccess cannot modify PHP settings such as mbstring.func_overload.
Apache AllowOverride = None - Configuration
Configure mbstring.func_overload in the global php.ini to the desired value and ensure it cannot be overridden per-directory (i.e., remove or disallow php_value/php_flag overrides in .htaccess). Restart Apache/PHP after changing php.ini.
PHP mbstring.func_overload = set in global php.ini only / disallow per-directory override - Operational
Search all hosted sites for .htaccess entries that set mbstring.func_overload (for example lines containing 'mbstring.func_overload' or 'php_value mbstring.func_overload') and remove or neutralize those entries; then restart Apache/PHP to apply the corrections.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0754?
CVE-2009-0754 is categorized as a moderate severity vulnerability due to its impact on local security settings.
How do I fix CVE-2009-0754?
To fix CVE-2009-0754, ensure that the mbstring.func_overload setting is secured and restrict .htaccess modifications to prevent unauthorized access.
Who is affected by CVE-2009-0754?
CVE-2009-0754 affects installations of PHP 4.4.4, 5.1.6, and potentially other versions running on Apache.
What systems are vulnerable to CVE-2009-0754?
Systems running PHP on Apache web servers, particularly those older versions of PHP, are vulnerable to CVE-2009-0754.
What are the implications of CVE-2009-0754?
CVE-2009-0754 can allow local users to alter PHP settings, which may lead to unintended behavior in applications hosted on the same server.