CVE-2013-1635: High severity php vulnerability

Q: What is the severity of CVE-2013-1635?

CVE-2013-1635 is considered to be of medium severity due to its potential for remote code execution.

Q: How do I fix CVE-2013-1635?

To fix CVE-2013-1635, users should upgrade to PHP versions that are higher than 5.3.21 or follow the security patches provided by their distribution.

Q: What causes CVE-2013-1635?

CVE-2013-1635 is caused by improper validation of the soap.wsdl_cache_dir configuration directive in PHP.

Q: Is CVE-2013-1635 exploitable remotely?

Yes, CVE-2013-1635 can be exploited remotely if the vulnerable PHP version is exposed on a public network.

Q: Which versions of PHP are affected by CVE-2013-1635?

CVE-2013-1635 affects PHP versions up to and including 5.3.21 and all 1.0, 2.0, 3.x versions.

Published Mar 5, 2013

Updated

A security flaw was found in the way PHP performed soap.wsdlcachedir configuration directive validation before projecting SOAP WSDL cache content to the local filesystem. A remote attacker could use this flaw to place SOAP WSDL files at arbitrary file system locations (locations accessible with the privileges of the PHP application).

References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221 [2] https://bugs.gentoo.org/showbug.cgi?id=459904 [3] http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:016/

Relevant upstream patch: [4] http://git.php.net/?p=php-src.git;a=commitdiff;h=702b436ef470cc02f8e2cc21f2fadeee42103c74

Other sources

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdlcachedir directive and the openbasedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

— MITRE

Affected Software

137 affected components

PHP PHP<=5.3.21

PHP PHP=1.0

PHP PHP=2.0

PHP PHP=2.0b10

PHP PHP=3.0

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=3.0.3

PHP PHP=3.0.4

PHP PHP=3.0.5

PHP PHP=3.0.6

PHP PHP=3.0.7

PHP PHP=3.0.8

PHP PHP=3.0.9

PHP PHP=3.0.10

PHP PHP=3.0.11

PHP PHP=3.0.12

PHP PHP=3.0.13

PHP PHP=3.0.14

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=3.0.17

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.0-beta1

PHP PHP=4.0-beta2

PHP PHP=4.0-beta3

PHP PHP=4.0-beta4

PHP PHP=4.0.0

PHP PHP=4.0.1

PHP PHP=4.0.2

PHP PHP=4.0.3

PHP PHP=4.0.4

PHP PHP=4.0.5

PHP PHP=4.0.6

PHP PHP=4.0.7

PHP PHP=4.1.0

PHP PHP=4.1.1

PHP PHP=4.1.2

PHP PHP=4.2.0

PHP PHP=4.2.1

PHP PHP=4.2.2

PHP PHP=4.2.3

PHP PHP=4.3.0

PHP PHP=4.3.1

PHP PHP=4.3.2

PHP PHP=4.3.3

PHP PHP=4.3.4

PHP PHP=4.3.5

PHP PHP=4.3.6

PHP PHP=4.3.7

PHP PHP=4.3.8

PHP PHP=4.3.9

PHP PHP=4.3.10

PHP PHP=4.3.11

PHP PHP=4.4.0

PHP PHP=4.4.1

PHP PHP=4.4.2

PHP PHP=4.4.3

PHP PHP=4.4.4

PHP PHP=4.4.5

PHP PHP=4.4.6

PHP PHP=4.4.7

PHP PHP=4.4.8

PHP PHP=4.4.9

PHP PHP=5.0.0

PHP PHP=5.0.0-beta1

PHP PHP=5.0.0-beta2

PHP PHP=5.0.0-beta3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0-rc1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.0-rc3

PHP PHP=5.0.1

PHP PHP=5.0.2

PHP PHP=5.0.3

PHP PHP=5.0.4

PHP PHP=5.0.5

PHP PHP=5.1.0

PHP PHP=5.1.1

PHP PHP=5.1.2

PHP PHP=5.1.3

PHP PHP=5.1.4

PHP PHP=5.1.5

PHP PHP=5.1.6

PHP PHP=5.2.0

PHP PHP=5.2.1

PHP PHP=5.2.2

PHP PHP=5.2.3

PHP PHP=5.2.4

PHP PHP=5.2.5

PHP PHP=5.2.6

PHP PHP=5.2.7

PHP PHP=5.2.8

PHP PHP=5.2.9

PHP PHP=5.2.10

PHP PHP=5.2.11

PHP PHP=5.2.12

PHP PHP=5.2.13

PHP PHP=5.2.14

PHP PHP=5.2.15

PHP PHP=5.2.16

PHP PHP=5.2.17

PHP PHP=5.3.0

PHP PHP=5.3.1

PHP PHP=5.3.2

PHP PHP=5.3.3

PHP PHP=5.3.4

PHP PHP=5.3.5

PHP PHP=5.3.6

PHP PHP=5.3.7

PHP PHP=5.3.8

PHP PHP=5.3.9

PHP PHP=5.3.10

PHP PHP=5.3.11

PHP PHP=5.3.12

PHP PHP=5.3.13

PHP PHP=5.3.14

PHP PHP=5.3.15

PHP PHP=5.3.16

PHP PHP=5.3.17

PHP PHP=5.3.18

PHP PHP=5.3.19

PHP PHP=5.3.20

PHP PHP=5.4.0

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

Event History

Mar 5, 2013

Data Sourced

05:07 PM

DescriptionSeverityAffected Software

Mar 6, 2013

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-1635?

CVE-2013-1635 is considered to be of medium severity due to its potential for remote code execution.

How do I fix CVE-2013-1635?