CVE-2012-1172: Input Validation

Q: What is the severity of CVE-2012-1172?

CVE-2012-1172 has been classified as a medium severity vulnerability due to its potential for causing denial of service and enabling directory traversal attacks.

Q: How do I fix CVE-2012-1172?

To fix CVE-2012-1172, update your PHP version to 5.4.0 or later where the vulnerability has been addressed.

Q: Which versions of PHP are affected by CVE-2012-1172?

CVE-2012-1172 affects PHP versions prior to 5.4.0, including all versions up to 5.3.10.

Q: What is the potential impact of CVE-2012-1172?

The potential impact of CVE-2012-1172 includes malformed $_FILES indexes leading to application instability and the risk of unauthorized file access.

Q: Is CVE-2012-1172 a critical vulnerability?

CVE-2012-1172 is not classified as critical but is a vulnerability that should be addressed due to its possible effects on application security and stability.

Published May 24, 2012

Updated

The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.

Affected Software

49 affected components

PHP PHP<=5.3.10

PHP PHP=5.0.0

PHP PHP=5.0.0-beta1

PHP PHP=5.0.0-beta2

PHP PHP=5.0.0-beta3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0-rc1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.0-rc3

PHP PHP=5.0.1

PHP PHP=5.0.2

PHP PHP=5.0.3

PHP PHP=5.0.4

PHP PHP=5.0.5

PHP PHP=5.1.0

PHP PHP=5.1.1

PHP PHP=5.1.2

PHP PHP=5.1.3

PHP PHP=5.1.4

PHP PHP=5.1.5

PHP PHP=5.1.6

PHP PHP=5.2.0

PHP PHP=5.2.1

PHP PHP=5.2.2

PHP PHP=5.2.3

PHP PHP=5.2.4

PHP PHP=5.2.5

PHP PHP=5.2.6

PHP PHP=5.2.7

PHP PHP=5.2.8

PHP PHP=5.2.9

PHP PHP=5.2.10

PHP PHP=5.2.11

PHP PHP=5.2.12

PHP PHP=5.2.13

PHP PHP=5.2.14

PHP PHP=5.2.15

PHP PHP=5.2.16

PHP PHP=5.2.17

PHP PHP=5.3.0

PHP PHP=5.3.1

PHP PHP=5.3.2

PHP PHP=5.3.3

PHP PHP=5.3.4

PHP PHP=5.3.5

PHP PHP=5.3.6

PHP PHP=5.3.7

PHP PHP=5.3.8

PHP PHP=5.3.9

Remediation

Patch Available

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/rfc1867.c?r1=321664&r2=321663&pathrev=321664

Event History

May 24, 2012

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-1172?

CVE-2012-1172 has been classified as a medium severity vulnerability due to its potential for causing denial of service and enabling directory traversal attacks.

How do I fix CVE-2012-1172?