CVE-2009-4418: Medium severity PHP PHP vulnerability

Q: What is the severity of CVE-2009-4418?

CVE-2009-4418 has a medium severity level as it can lead to denial of service through resource consumption.

Q: How do I fix CVE-2009-4418?

To fix CVE-2009-4418, upgrade to PHP version 5.3.1 or higher where the vulnerability has been addressed.

Q: Which versions of PHP are affected by CVE-2009-4418?

CVE-2009-4418 affects PHP versions 5.3.0 and earlier, including various 5.2.x and 5.1.x versions.

Q: What is the impact of CVE-2009-4418 on web applications?

CVE-2009-4418 can be exploited to trigger a denial of service by causing excessive resource usage, affecting web application availability.

Q: Is there a workaround for CVE-2009-4418 if I cannot upgrade PHP?

A potential workaround for CVE-2009-4418 is to limit the input size and depth of serialized variables processed by the unserialize function.

Published Dec 24, 2009

Updated

The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.

Affected Software

38 affected components

PHP PHP=5.2.9

PHP PHP=5.2.4

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=5.1.1

PHP PHP=5.0.0-beta1

PHP PHP=5.1.6

PHP PHP=5.0-rc1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=5.0.4

PHP PHP=5.0-rc3

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.0.0-rc3

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=5.2.4

PHP PHP=5.0.0-beta3

PHP PHP=5.1.3

PHP PHP=5.2.10

PHP PHP=5.0.0-rc1

PHP PHP=5.0.2

PHP PHP=5.2.1

PHP PHP=5.0.0-beta4

PHP PHP=5

PHP PHP=5.0.0

PHP PHP=5.0.0-beta2

PHP PHP=5.2.8

PHP PHP<=5.3.0

Event History

Dec 24, 2009

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-4418?

CVE-2009-4418 has a medium severity level as it can lead to denial of service through resource consumption.

How do I fix CVE-2009-4418?

To fix CVE-2009-4418, upgrade to PHP version 5.3.1 or higher where the vulnerability has been addressed.

Which versions of PHP are affected by CVE-2009-4418?