CVE-2009-4024

Published: Nov 29, 2009Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Argument injection vulnerability in the ping function in Ping.php in the Net_Ping package before 2.4.5 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: this has also been reported as a shell metacharacter problem.

Affected (11)

Products: Pear: Pear

1 product

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Pear Pear	Up to 2.4.4
Pear Pear	Version 0.1
Pear Pear	Version 1.0.1
Pear Pear	Version 1.0
Pear Pear	Version 2.1
Pear Pear	Version 2.2
Pear Pear	Version 2.3
Pear Pear	Version 2.4.1
Pear Pear	Version 2.4.2
Pear Pear	Version 2.4.3
Pear Pear	Version 2.4

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (26)

http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/

Source: secalert@redhat.com

Patch

http://pear.php.net/advisory20091114-01.txt

Source: secalert@redhat.com

Vendor Advisory

http://pear.php.net/package/Net_Ping/download/2.4.5

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/37451

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/37502

Source: secalert@redhat.com

http://svn.php.net/viewvc/pear/packages/Net_Ping/trunk/Ping.php?r1=274728&r2=290669&pathrev=290669

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1949

Source: secalert@redhat.com

http://www.securityfocus.com/bid/37093

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/3320

Source: secalert@redhat.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/54390

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01044.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01130.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01152.html

Source: secalert@redhat.com

http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://pear.php.net/advisory20091114-01.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://pear.php.net/package/Net_Ping/download/2.4.5

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://secunia.com/advisories/37451

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/37502

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.php.net/viewvc/pear/packages/Net_Ping/trunk/Ping.php?r1=274728&r2=290669&pathrev=290669

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1949

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/37093

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/3320

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/54390

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01044.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01130.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01152.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.