CVE-2010-1129: Input Validation

Published Mar 26, 2010

Updated

The safemode implementation in PHP before 5.2.13 does not properly handle directory pathnames that lack a trailing / (slash) character, which allows context-dependent attackers to bypass intended access restrictions via vectors related to use of the tempnam function.

Affected Software

13 affected components

PHP PHP=5.2.9

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.2.3

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.2.10

PHP PHP=5.2.1

PHP PHP=5.2.8

Remediation

Patch Available

http://www.php.net/releases/5_2_13.php

Event History

Mar 26, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Data Sourced

via NVD·08:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1129?

CVE-2010-1129 has a severity rating of medium, indicating it poses a moderate risk to system integrity.

How do I fix CVE-2010-1129?

To fix CVE-2010-1129, upgrade PHP to version 5.2.13 or later to ensure proper handling of directory pathnames.

What PHP versions are affected by CVE-2010-1129?

CVE-2010-1129 affects PHP versions prior to 5.2.13, specifically 5.2.0 through 5.2.12.

What type of vulnerability is CVE-2010-1129?

CVE-2010-1129 is a path traversal vulnerability that allows unauthorized access due to improper pathname handling.

Can CVE-2010-1129 be exploited remotely?

Yes, CVE-2010-1129 can potentially be exploited remotely by context-dependent attackers to bypass access restrictions.