CVE-2009-3557

Published: Nov 23, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments.

Affected (63)

Products: Php: Php

1 product

Configuration A

63 vulnerable

Vulnerable Software	Affected Versions
Php Php	Up to 5.2.11
Php Php	Version 1.0
Php Php	Version 2.0
Php Php	Version 2.0b10
Php Php	Version 3.0.10
Php Php	Version 3.0.11
Php Php	Version 3.0.12
Php Php	Version 3.0.13
Php Php	Version 3.0.14
Php Php	Version 3.0.15
Php Php	Version 3.0.16
Php Php	Version 3.0.17
Php Php	Version 3.0.18
Php Php	Version 3.0.1
Php Php	Version 3.0.2
Php Php	Version 3.0.3
Php Php	Version 3.0.4
Php Php	Version 3.0.5
Php Php	Version 3.0.6
Php Php	Version 3.0.7
Php Php	Version 3.0.8
Php Php	Version 3.0.9
Php Php	Version 3.0
Php Php	Version 4.0.0
Php Php	Version 4.0.1
Php Php	Version 4.0.2
Php Php	Version 4.0.3
Php Php	Version 4.0.4
Php Php	Version 4.0.5
Php Php	Version 4.0.6
Php Php	Version 4.0.7
Php Php	Version 4.0
Php Php	Version 4.0 beta1
Php Php	Version 4.0 beta2
Php Php	Version 4.0 beta3
Php Php	Version 4.0 beta4
Php Php	Version 4.0 beta_4_patch1
Php Php	Version 4.1.0
Php Php	Version 4.1.1
Php Php	Version 4.1.2
Php Php	Version 4.2.0
Php Php	Version 4.2.1
Php Php	Version 4.2.2
Php Php	Version 4.2.3
Php Php	Version 4.3.0
Php Php	Version 4.3.10
Php Php	Version 4.3.11
Php Php	Version 4.3.1
Php Php	Version 4.3.2
Php Php	Version 4.3.7
Php Php	Version 4.4.2
Php Php	Version 4.4.7
Php Php	Version 4.4.8
Php Php	Version 4.4.9
Php Php	Version 5.0.0
Php Php	Version 5.0.0 beta4
Php Php	Version 5.0.3
Php Php	Version 5.1.1
Php Php	Version 5.2.10
Php Php	Version 5.2.1
Php Php	Version 5.2.5
Php Php	Version 5.2.6
Php Php	Version 5.3.0

Related CWEs

References (44)

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=127680701405735&w=2

Source: secalert@redhat.com

http://news.php.net/php.announce/79

Source: secalert@redhat.com

http://secunia.com/advisories/37412

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/37821

Source: secalert@redhat.com

http://secunia.com/advisories/40262

Source: secalert@redhat.com

http://securityreason.com/securityalert/6601

Source: secalert@redhat.com

Exploit

http://support.apple.com/kb/HT4077

Source: secalert@redhat.com

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/standard/file.c?view=log

Source: secalert@redhat.com

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/standard/file.c?view=log

Source: secalert@redhat.com

http://svn.php.net/viewvc?view=revision&revision=288945

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:285

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:302

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:303

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2009/11/20/2

Source: secalert@redhat.com

Patch

http://www.openwall.com/lists/oss-security/2009/11/20/3

Source: secalert@redhat.com

Patch

http://www.openwall.com/lists/oss-security/2009/11/20/5

Source: secalert@redhat.com

Patch

http://www.php.net/ChangeLog-5.php

Source: secalert@redhat.com

PatchVendor Advisory

http://www.php.net/releases/5_2_12.php

Source: secalert@redhat.com

http://www.php.net/releases/5_3_1.php

Source: secalert@redhat.com

PatchVendor Advisory

http://www.vupen.com/english/advisories/2009/3593

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7396

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=127680701405735&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://news.php.net/php.announce/79

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37412

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/37821

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/40262

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/6601

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://support.apple.com/kb/HT4077

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/standard/file.c?view=log

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/standard/file.c?view=log

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.php.net/viewvc?view=revision&revision=288945

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2009:285

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2009:302

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2009:303

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/11/20/2

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.openwall.com/lists/oss-security/2009/11/20/3

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.openwall.com/lists/oss-security/2009/11/20/5

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.php.net/ChangeLog-5.php

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.php.net/releases/5_2_12.php

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.php.net/releases/5_3_1.php

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.vupen.com/english/advisories/2009/3593

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7396

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.