CVE-2013-4248: Input Validation

Q: What is the severity of CVE-2013-4248?

CVE-2013-4248 is classified as a medium-severity vulnerability that allows man-in-the-middle attacks.

Q: How do I fix CVE-2013-4248?

To fix CVE-2013-4248, upgrade PHP to version 5.4.18 or later, or 5.5.2 or later.

Q: Which software versions are affected by CVE-2013-4248?

CVE-2013-4248 affects PHP versions prior to 5.4.18 and 5.5.x prior to 5.5.2, as well as several Ubuntu Linux versions.

Q: What kind of attacks can CVE-2013-4248 facilitate?

CVE-2013-4248 can facilitate man-in-the-middle attacks allowing attackers to spoof SSL certificates.

Q: Is CVE-2013-4248 still a concern for current PHP installations?

CVE-2013-4248 should not be a concern if you are using a supported version of PHP that has been updated.

Published Aug 18, 2013

Updated

The opensslx509parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected Software

95 affected components

Canonical Ubuntu Linux=10.04

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=12.10

Canonical Ubuntu Linux=13.04

PHP PHP<=5.4.17

PHP PHP=5.0.0

PHP PHP=5.0.0-beta1

PHP PHP=5.0.0-beta2

PHP PHP=5.0.0-beta3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0-rc1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.0-rc3

PHP PHP=5.0.1

PHP PHP=5.0.2

PHP PHP=5.0.3

PHP PHP=5.0.4

PHP PHP=5.0.5

PHP PHP=5.1.0

PHP PHP=5.1.1

PHP PHP=5.1.2

PHP PHP=5.1.3

PHP PHP=5.1.4

PHP PHP=5.1.5

PHP PHP=5.1.6

PHP PHP=5.2.0

PHP PHP=5.2.1

PHP PHP=5.2.2

PHP PHP=5.2.3

PHP PHP=5.2.4

PHP PHP=5.2.5

PHP PHP=5.2.6

PHP PHP=5.2.7

PHP PHP=5.2.8

PHP PHP=5.2.9

PHP PHP=5.2.10

PHP PHP=5.2.11

PHP PHP=5.2.12

PHP PHP=5.2.13

PHP PHP=5.2.14

PHP PHP=5.2.15

PHP PHP=5.2.16

PHP PHP=5.2.17

PHP PHP=5.3.0

PHP PHP=5.3.1

PHP PHP=5.3.2

PHP PHP=5.3.3

PHP PHP=5.3.4

PHP PHP=5.3.5

PHP PHP=5.3.6

PHP PHP=5.3.7

PHP PHP=5.3.8

PHP PHP=5.3.9

PHP PHP=5.3.10

PHP PHP=5.3.11

PHP PHP=5.3.12

PHP PHP=5.3.13

PHP PHP=5.3.14

PHP PHP=5.3.15

PHP PHP=5.3.16

PHP PHP=5.3.17

PHP PHP=5.3.18

PHP PHP=5.3.19

PHP PHP=5.3.20

PHP PHP=5.3.21

PHP PHP=5.3.22

PHP PHP=5.3.23

PHP PHP=5.3.24

PHP PHP=5.3.25

PHP PHP=5.3.26

PHP PHP=5.3.27

PHP PHP=5.4.0

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

PHP PHP=5.4.12-rc1

PHP PHP=5.4.12-rc2

PHP PHP=5.4.13

PHP PHP=5.4.13-rc1

PHP PHP=5.4.14

PHP PHP=5.4.14-rc1

PHP PHP=5.4.15-rc1

PHP PHP=5.4.16-rc1

PHP PHP=5.5.0

PHP PHP=5.5.1

redhat Enterprise Linux=5

Event History

Aug 18, 2013

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-4248?

CVE-2013-4248 is classified as a medium-severity vulnerability that allows man-in-the-middle attacks.

How do I fix CVE-2013-4248?

To fix CVE-2013-4248, upgrade PHP to version 5.4.18 or later, or 5.5.2 or later.

Which software versions are affected by CVE-2013-4248?