#VU44946 Permissions, Privileges, and Access Controls in PHP - CVE-2011-2202

Vulnerability identifier: #VU44946

Vulnerability risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2011-2202

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
PHP
Universal components / Libraries / Scripting languages

Vendor: PHP Group

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."

Mitigation
Install update from vendor's website.

Vulnerable software versions

PHP: 1.0, 2.0b10, 2.0, 3.0 - 3.0.18, 4.0 - 4.0.7, 4.1.0 - 4.1.2, 4.2.0 - 4.2.3, 4.3.0 - 4.3.11, 4.4.0 - 4.4.9, 5.3.0 - 5.3.5

---

External links
https://bugs.php.net/bug.php?id=54939
https://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
https://marc.info/?l=bugtraq&m=133469208622507&w=2
https://openwall.com/lists/oss-security/2011/06/12/5
https://openwall.com/lists/oss-security/2011/06/13/15
https://pastebin.com/1edSuSVN
https://rhn.redhat.com/errata/RHSA-2012-0071.html
https://secunia.com/advisories/44874
https://securitytracker.com/id?1025659
https://support.apple.com/kb/HT5130
https://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/rfc1867.c?r1=312103&r2=312102&pathrev=312103
https://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/NEWS?view=markup&pathrev=312103
https://svn.php.net/viewvc?view=revision&revision=312103
https://www.debian.org/security/2011/dsa-2266
https://www.mandriva.com/security/advisories?name=MDVSA-2011:165
https://www.php.net/archive/2011.php#id2011-08-18-1
https://www.php.net/ChangeLog-5.php#5.3.7
https://www.redhat.com/support/errata/RHSA-2011-1423.html
https://www.securityfocus.com/bid/48259
https://www.securityfocus.com/bid/49241
https://exchange.xforce.ibmcloud.com/vulnerabilities/67999

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.