Vulnerability identifier: #VU44946

Vulnerability risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2011-2202

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
PHP
Universal components / Libraries / Scripting languages

Vendor: PHP Group

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."

Mitigation
Install update from vendor's website.

Vulnerable software versions

PHP: 3.0 - 3.0.18, 4.0 - 4.0.7, 4.1.0 - 4.1.2, 4.2.0 - 4.2.3, 4.3.0 - 4.3.11, 4.4.0 - 4.4.9, 5.3.0 - 5.3.5

---

External links
http://bugs.php.net/bug.php?id=54939
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
http://marc.info/?l=bugtraq&m=133469208622507&w=2
http://openwall.com/lists/oss-security/2011/06/12/5
http://openwall.com/lists/oss-security/2011/06/13/15
http://pastebin.com/1edSuSVN
http://rhn.redhat.com/errata/RHSA-2012-0071.html
http://secunia.com/advisories/44874
http://securitytracker.com/id?1025659
http://support.apple.com/kb/HT5130
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/rfc1867.c?r1=312103&r2=312102&pathrev=312103
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/NEWS?view=markup&pathrev=312103
http://svn.php.net/viewvc?view=revision&revision=312103
http://www.debian.org/security/2011/dsa-2266
http://www.mandriva.com/security/advisories?name=MDVSA-2011:165
http://www.php.net/archive/2011.php#id2011-08-18-1
http://www.php.net/ChangeLog-5.php#5.3.7
http://www.redhat.com/support/errata/RHSA-2011-1423.html
http://www.securityfocus.com/bid/48259
http://www.securityfocus.com/bid/49241
http://exchange.xforce.ibmcloud.com/vulnerabilities/67999

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.