CVE-2010-1130: Medium severity PHP PHP vulnerability

Q: What is the severity of CVE-2010-1130?

CVE-2010-1130 has a medium severity rating due to its potential for local exploitation affecting the security of the PHP environment.

Q: How do I fix CVE-2010-1130?

To fix CVE-2010-1130, upgrade PHP to version 5.2.13 or later, or 5.3.1 or later.

Q: Which versions of PHP are affected by CVE-2010-1130?

CVE-2010-1130 affects PHP versions before 5.2.13 and 5.3.1, including multiple earlier versions.

Q: Can CVE-2010-1130 be exploited remotely?

CVE-2010-1130 typically requires local access to exploit, as it involves manipulating session save paths.

Q: What are the risks of leaving CVE-2010-1130 unpatched?

Leaving CVE-2010-1130 unpatched can allow attackers to bypass open_basedir and safe_mode protections, leading to increased risk of unauthorized file access.

Published Mar 26, 2010

Updated

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the sessionsavepath function, which allows context-dependent attackers to bypass openbasedir and safemode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

Affected Software

35 affected components

PHP PHP=5.2.9

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=5.3.1

PHP PHP=5.1.1

PHP PHP=5.0.0-beta1

PHP PHP=5.1.6

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=5.0.4

PHP PHP<=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.2.13

PHP PHP=5.0.0-rc3

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.0.0-beta3

PHP PHP=5.1.3

PHP PHP=5.2.10

PHP PHP=5.0.0-rc1

PHP PHP=5.0.2

PHP PHP=5.2.1

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=5.0.0-beta2

PHP PHP=5.2.8

Remediation

Patch Available

http://www.php.net/releases/5_2_13.php

Event History

Mar 26, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Data Sourced

via NVD·08:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1130?

CVE-2010-1130 has a medium severity rating due to its potential for local exploitation affecting the security of the PHP environment.

How do I fix CVE-2010-1130?