CVE-2008-3660

Published: Aug 15, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

PHP 4.4.x before 4.4.9, and 5.x through 5.2.6, when used as a FastCGI module, allows remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using foo..php.

Affected (16)

Products: Php: Php

Php

1 product

Php

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Php Php	Version 4.4.0
Php Php	Version 4.4.1
Php Php	Version 4.4.2
Php Php	Version 4.4.3
Php Php	Version 4.4.4
Php Php	Version 4.4.5
Php Php	Version 4.4.6
Php Php	Version 4.4.7
Php Php	Version 4.4.8
Php Php	Version 5.2.0
Php Php	Version 5.2.1
Php Php	Version 5.2.2
Php Php	Version 5.2.3
Php Php	Version 5.2.4
Php Php	Version 5.2.5
Php Php	Version 5.2.6

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (62)

http://bugs.gentoo.org/show_bug.cgi?id=234102

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=124654546101607&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=125631037611762&w=2

Source: cve@mitre.org

http://secunia.com/advisories/31982

Source: cve@mitre.org

http://secunia.com/advisories/32148

Source: cve@mitre.org

http://secunia.com/advisories/32746

Source: cve@mitre.org

http://secunia.com/advisories/35074

Source: cve@mitre.org

http://secunia.com/advisories/35306

Source: cve@mitre.org

http://secunia.com/advisories/35650

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200811-05.xml

Source: cve@mitre.org

http://support.apple.com/kb/HT3549

Source: cve@mitre.org

http://wiki.rpath.com/Advisories:rPSA-2009-0035

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1647

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2009:021

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2009:022

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2009:023

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2009:024

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/08/08/2

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/08/13/8

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0350.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/501376/100/0/threaded

Source: cve@mitre.org

http://www.securitytracker.com/id?1020994

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2008/2336

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1297

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/44402

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9597

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html

Source: cve@mitre.org

http://bugs.gentoo.org/show_bug.cgi?id=234102