CVE-2009-4018: High severity php vulnerability

Q: What is the severity of CVE-2009-4018?

CVE-2009-4018 has been classified as a critical vulnerability due to its ability to allow attackers to execute arbitrary programs with a malicious environment.

Q: How do I fix CVE-2009-4018?

To fix CVE-2009-4018, upgrade your PHP installation to version 5.2.11 or later, or 5.3.1 or later.

Q: Which versions of PHP are affected by CVE-2009-4018?

CVE-2009-4018 affects PHP versions before 5.2.11 and 5.3.x before 5.3.1, including several earlier versions.

Q: What types of attacks can result from CVE-2009-4018?

The vulnerability can lead to remote code execution, allowing attackers to run arbitrary code by manipulating the environment variables.

Q: Is CVE-2009-4018 still a concern for users today?

While CVE-2009-4018 primarily affects outdated PHP versions, any systems still utilizing these versions are at risk and should be updated.

Published Nov 27, 2009

Updated

The procopen function in ext/standard/procopen.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safemodeallowedenvvars and (2) safemodeprotectedenvvars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LDLIBRARYPATH environment variable.

Affected Software

110 affected components

PHP PHP=4.3.9

PHP PHP=4.4.9

PHP PHP=3.0

PHP PHP=5.2.9

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=4.0.7-rc4

PHP PHP=5.1.4

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP<=5.2.10

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=5.2.6

PHP PHP=5.3.0

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.4.5

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=2.0b10

PHP PHP=4.4.8

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=5.2.4

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=5.0.2

PHP PHP=4.4.6

PHP PHP=3.0.12

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

PHP PHP=5.2.8

PHP PHP=4.4.7

Remediation

Event History

Nov 27, 2009

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-4018?

CVE-2009-4018 has been classified as a critical vulnerability due to its ability to allow attackers to execute arbitrary programs with a malicious environment.

How do I fix CVE-2009-4018?

To fix CVE-2009-4018, upgrade your PHP installation to version 5.2.11 or later, or 5.3.1 or later.

Which versions of PHP are affected by CVE-2009-4018?

CVE-2009-4018 affects PHP versions before 5.2.11 and 5.3.x before 5.3.1, including several earlier versions.

What types of attacks can result from CVE-2009-4018?

The vulnerability can lead to remote code execution, allowing attackers to run arbitrary code by manipulating the environment variables.

Is CVE-2009-4018 still a concern for users today?

While CVE-2009-4018 primarily affects outdated PHP versions, any systems still utilizing these versions are at risk and should be updated.

CVE-2009-4018: High severity php vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2009-4018?

How do I fix CVE-2009-4018?

Which versions of PHP are affected by CVE-2009-4018?

What types of attacks can result from CVE-2009-4018?

Is CVE-2009-4018 still a concern for users today?

Company

Resources

Contact