New Search

HP-UX Running Apache with PHP Remote Denial of Service (DoS) Unauthorized Access Privileged Access Cross Site Scripting (XSS)

oval:org.mitre.oval:def:7256

The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable.

Family:
unix
Status:
ACCEPTED
Platform(s):
  • HP-UX 11
Class:
vulnerability
Reference(s):
  • CVE-2009-4018
Product(s):