CVE-2009-4017: Medium severity php vulnerability
PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the maxfileuploads directive.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4017?
CVE-2009-4017 has a medium severity rating as it can lead to denial of service through resource exhaustion.
How do I fix CVE-2009-4017?
To mitigate CVE-2009-4017, update PHP to version 5.2.12 or 5.3.1 or later.
Which versions of PHP are affected by CVE-2009-4017?
PHP versions before 5.2.12 and 5.3.x before 5.3.1 are affected by CVE-2009-4017.
What kind of attack is possible due to CVE-2009-4017?
CVE-2009-4017 allows remote attackers to cause denial of service through excessive temporary file creation.
Is there any link between CVE-2009-4017 and local file inclusion vulnerabilities?
Yes, CVE-2009-4017 increases the potential for local file inclusion attacks due to the inadequacy in handling temporary files.