CVE-2012-4388: Input Validation
The sapiheaderop function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4388?
CVE-2012-4388 has a medium severity level as it allows remote attackers to bypass HTTP response-splitting protections.
How do I fix CVE-2012-4388?
To fix CVE-2012-4388, upgrade PHP to a version later than 5.4.0 that addresses this vulnerability.
What versions of PHP are affected by CVE-2012-4388?
CVE-2012-4388 affects PHP versions from 5.4.0RC2 through 5.4.0, as well as 5.3.0 to 5.3.11.
Can CVE-2012-4388 be exploited remotely?
Yes, CVE-2012-4388 can be exploited remotely through crafted URLs that bypass the protection mechanism.
Which operating systems are impacted by CVE-2012-4388?
CVE-2012-4388 impacts various operating systems, including Ubuntu Linux 8.04 to 12.04 and Debian Linux 6.0.