cvelistv5 - cve-2002-0985

CVE-2002-0985 (GCVE-0-2002-0985)

Vulnerability from cvelistv5

Published

2004-09-01 04:00

Modified

2024-08-08 03:12

Severity ?

CWE

Summary

Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.

References

►

URL

	Vendor	Product	Version
	n/a	n/a	Version: n/a

rhsa-2002:244

Vulnerability from csaf_redhat

Published

2002-11-08 11:15

Modified

2024-11-21 22:31

Summary

Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold

Notes

Topic

Updated versions of the Apache HTTP server, PHP, and mod_ssl are now available which close possible buffer overflows in the Apache HTTP server benchmarking tool, fix two cross-site scripting vulnerabilities in the error pages, and fix possible local privilege escalation. These updates also fix vulnerabilities in the PHP mail() function that allows script authors to bypass safe mode restrictions, and possibly allow remote attackers to insert arbitrary mail headers and content into messages.

Details

The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP server. Buffer overflows in the ApacheBench support program (ab.c) in Apache versions prior to 1.3.27 allow a malicious Web server to cause a denial of service and possibly execute arbitrary code via a long response. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0843 to this issue. Two cross-site scripting vulnerabilities are present in the error pages for the default "404 Not Found" error, and for the error response when a plain HTTP request is received on an SSL port. Both of these issues are only exploitable if the "UseCanonicalName" setting has been changed to "Off", and wildcard DNS is in use. These issues would allow remote attackers to execute scripts as other Web page visitors, for instance, to steal cookies. These issues affect Apache versions 1.3 to 1.3.26, and mod_ssl versions before 2.8.12. The Common Vulnerabilities and Exposures project has assigned the names CAN-2002-0840 and CAN-2002-1157 to these issues. The shared memory scoreboard in the HTTP daemon for Apache 1.3.x, prior to version 1.3.27 allowed a user running as the web server user to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or other such behavior that would not normally be allowed. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-839 to this issue. The mail function in PHP 4.x to 4.2.2 may allow local script authors to bypass safe mode restrictions and modify command line arguments to the MTA (such as Sendmail) in the fifth argument to mail(), altering MTA behavior and possibly executing arbitrary local commands. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0985 to this issue. The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy". The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0986 to this issue. Stronghold 4 contains Apache 1.3.22, mod_ssl 2.8.7, and PHP 4.1.2, and is therefore vulnerable to these issues. Users of Stronghold are advised to patch or upgrade their servers.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated versions of the Apache HTTP server, PHP, and mod_ssl are now\navailable which close possible buffer overflows in the Apache HTTP server\nbenchmarking tool, fix two cross-site scripting vulnerabilities in the\nerror pages, and fix possible local privilege escalation.  These updates\nalso fix vulnerabilities in the PHP mail() function that allows script\nauthors to bypass safe mode restrictions, and possibly allow remote\nattackers to insert arbitrary mail headers and content into messages.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Apache HTTP server is a powerful, full-featured, efficient, and\nfreely-available Web server.  PHP is an HTML-embedded scripting language\ncommonly used with the Apache HTTP server.\n\nBuffer overflows in the ApacheBench support program (ab.c) in Apache\nversions prior to 1.3.27 allow a malicious Web server to cause a denial of\nservice and possibly execute arbitrary code via a long response.  The\nCommon Vulnerabilities and Exposures project has assigned the name\nCAN-2002-0843 to this issue.\n\nTwo cross-site scripting vulnerabilities are present in the error pages\nfor the default \"404 Not Found\" error, and for the error response when a\nplain HTTP request is received on an SSL port.  Both of these issues are\nonly exploitable if the \"UseCanonicalName\" setting has been changed to\n\"Off\", and wildcard DNS is in use.  These issues would allow remote\nattackers to execute scripts as other Web page visitors, for instance, to\nsteal cookies.  These issues affect Apache versions 1.3 to 1.3.26,\nand mod_ssl versions before 2.8.12.  The Common Vulnerabilities and\nExposures project has assigned the names CAN-2002-0840 and\nCAN-2002-1157 to these issues.\n\nThe shared memory scoreboard in the HTTP daemon for Apache 1.3.x, prior to\nversion 1.3.27 allowed a user running as the web server user to send a\nSIGUSR1 signal to any process as root, resulting in a denial of service\n(process kill) or other such behavior that would not normally be allowed. \nThe Common Vulnerabilities and Exposures project has assigned the name\nCAN-2002-839 to this issue.\n\nThe mail function in PHP 4.x to 4.2.2 may allow local script authors to\nbypass safe mode restrictions and modify command line arguments to the\nMTA (such as Sendmail) in the fifth argument to mail(), altering MTA\nbehavior and possibly executing arbitrary local commands. The Common\nVulnerabilities and Exposures project has assigned the name CAN-2002-0985\nto this issue.\n\nThe mail function in PHP 4.x to 4.2.2 does not filter ASCII control\ncharacters from its arguments, which could allow remote attackers to\nmodify mail message content, including mail headers, and possibly use\nPHP as a \"spam proxy\". The Common Vulnerabilities and Exposures project has\nassigned the name CAN-2002-0986 to this issue.\n\nStronghold 4 contains Apache 1.3.22, mod_ssl 2.8.7, and PHP 4.1.2, and\nis therefore vulnerable to these issues. Users of Stronghold are advised to\npatch or upgrade their servers.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:244",
        "url": "https://access.redhat.com/errata/RHSA-2002:244"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://www.apacheweek.com/issues/02-10-04",
        "url": "http://www.apacheweek.com/issues/02-10-04"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_244.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold",
    "tracking": {
      "current_release_date": "2024-11-21T22:31:24+00:00",
      "generator": {
        "date": "2024-11-21T22:31:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:244",
      "initial_release_date": "2002-11-08T11:15:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-08T11:15:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-10-07T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:31:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Stronghold 4",
                "product": {
                  "name": "Red Hat Stronghold 4",
                  "product_id": "Red Hat Stronghold 4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:stronghold:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold Cross Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-0839",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0839"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0839",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0839"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0839",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0839"
        }
      ],
      "release_date": "2002-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "We have backported the security fixes for the versions of OpenSSL\nand mm included in Stronghold 4. The fixed packages are now available via\nthe update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:244"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0840",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is \"Off\" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0840"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0840",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0840"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0840",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0840"
        }
      ],
      "release_date": "2002-10-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "We have backported the security fixes for the versions of OpenSSL\nand mm included in Stronghold 4. The fixed packages are now available via\nthe update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:244"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0843",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0843"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0843",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0843"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0843",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0843"
        }
      ],
      "release_date": "2002-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "We have backported the security fixes for the versions of OpenSSL\nand mm included in Stronghold 4. The fixed packages are now available via\nthe update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:244"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0985",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0985",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "We have backported the security fixes for the versions of OpenSSL\nand mm included in Stronghold 4. The fixed packages are now available via\nthe update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:244"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0986",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a \"spam proxy.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0986",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "We have backported the security fixes for the versions of OpenSSL\nand mm included in Stronghold 4. The fixed packages are now available via\nthe update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:244"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1157",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616849"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1157"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616849",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1157",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1157"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1157",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1157"
        }
      ],
      "release_date": "2002-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "We have backported the security fixes for the versions of OpenSSL\nand mm included in Stronghold 4. The fixed packages are now available via\nthe update agent service; run\n\n$ bin/agent\n\nfrom the Stronghold 4 install root to upgrade an existing Stronghold 4\ninstallation to the new package versions. After upgrading Stronghold, the\nserver must be completely restarted by running the following commands from\nthe install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nsee http://stronghold.redhat.com/support/upgrade-sh4",
          "product_ids": [
            "Red Hat Stronghold 4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:244"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    }
  ]
}

rhsa-2003:159

Vulnerability from csaf_redhat

Published

2003-06-30 14:37

Modified

2024-11-21 22:31

Summary

Red Hat Security Advisory: : : : New PHP packages fix vulnerabilities

Notes

Topic

Updated PHP packages are available for Red Hat Linux on IBM iSeries and pSeries systems.

Details

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP server. The mail function in PHP 4.x to 4.2.2 may allow local script authors to bypass safe mode restrictions and modify command line arguments to an MTA (such as Sendmail). Specifically, the fifth argument to mail() may be modified, altering MTA behavior and possibly allowing the execution of arbitrary local commands. The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy." Script authors should note that all input should be checked for unsafe data by any PHP scripts calling functions such as mail(). PHP versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse the 5th parameter to the mail() function. This vulnerability allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters. Note that this PHP errata enforces memory limits on the size of the PHP process to prevent a badly generated script from becoming a possible source for a denial of service attack. The default process size is 8MB, though you can adjust this as necessary through the php.ini directive memory_limit. For example, to change the process memory limit to 4MB, add the following: memory_limit 4194304 Important Note: Your original /etc/php.ini configuration file is not replaced or overwritten. Therefore, you should carefully review your configuration file and adapt it as necessary to your server or service functions.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated PHP packages are available for Red Hat Linux on IBM iSeries and\npSeries systems.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "PHP is an HTML-embedded scripting language commonly used with the Apache\nHTTP server. \n\nThe mail function in PHP 4.x to 4.2.2 may allow local script authors to\nbypass safe mode restrictions and modify command line arguments to an\nMTA (such as Sendmail).  Specifically, the fifth argument to mail() may be\nmodified, altering MTA behavior and possibly allowing the execution of\narbitrary local commands.\n\nThe mail function in PHP 4.x to 4.2.2 does not filter ASCII control\ncharacters from its arguments, which could allow remote attackers to\nmodify mail message content, including mail headers, and possibly use\nPHP as a \"spam proxy.\"\n\nScript authors should note that all input should be checked for unsafe data\nby any PHP scripts calling functions such as mail().\n\nPHP versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse\nthe 5th parameter to the mail() function. This vulnerability allows local\nusers and possibly remote attackers to execute arbitrary commands via shell\nmetacharacters.\n\nNote that this PHP errata enforces memory limits on the size of the PHP\nprocess to prevent a badly generated script from becoming a possible source\nfor a denial of service attack. The default process size is 8MB, though you\ncan adjust this as necessary through the php.ini directive memory_limit.\nFor example, to change the process memory limit to 4MB, add\nthe following:\n\nmemory_limit 4194304\n\nImportant Note:\n\nYour original /etc/php.ini configuration file is not replaced or\noverwritten. Therefore, you should carefully review your configuration file\nand adapt it as necessary to your server or service functions.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2003:159",
        "url": "https://access.redhat.com/errata/RHSA-2003:159"
      },
      {
        "category": "external",
        "summary": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103011916928204",
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=103011916928204"
      },
      {
        "category": "external",
        "summary": "http://online.securityfocus.com/archive/1/194425",
        "url": "http://online.securityfocus.com/archive/1/194425"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_159.json"
      }
    ],
    "title": "Red Hat Security Advisory: : : : New PHP packages fix vulnerabilities",
    "tracking": {
      "current_release_date": "2024-11-21T22:31:38+00:00",
      "generator": {
        "date": "2024-11-21T22:31:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2003:159",
      "initial_release_date": "2003-06-30T14:37:00+00:00",
      "revision_history": [
        {
          "date": "2003-06-30T14:37:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2003-06-30T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:31:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.1",
                "product": {
                  "name": "Red Hat Linux 7.1",
                  "product_id": "Red Hat Linux 7.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2001-1246",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616654"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2001-1246"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616654",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616654"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2001-1246",
          "url": "https://www.cve.org/CVERecord?id=CVE-2001-1246"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1246",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1246"
        }
      ],
      "release_date": "2001-06-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-30T14:37:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:159"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0985",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0985",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-30T14:37:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:159"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0986",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a \"spam proxy.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0986",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-30T14:37:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:159"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    }
  ]
}

rhsa-2002:248

Vulnerability from csaf_redhat

Published

2002-11-07 17:42

Modified

2024-11-21 22:31

Summary

Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold

Notes

Topic

Updated versions of the Apache HTTP server, PHP, and mod_ssl are now available which close possible buffer overflows in the Apache HTTP server benchmarking tool, fixes two cross-site scripting vulnerabilities in the error pages, and fix possible local privilege escalation. These updates also fix vulnerabilities in the PHP mail() function that allows script authors to bypass safe mode restrictions, and possibly allow remote attackers to insert arbitrary mail headers and content into messages.

Details

The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP server. Buffer overflows in the ApacheBench support program (ab.c) in Apache versions prior to 1.3.27, allow a malicious Web server to cause a denial of service and possibly execute arbitrary code via a long response. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0843 to this issue. Two cross-site scripting vulnerabilities are present in the error pages for the default "404 Not Found" error, and for the error response when a plain HTTP request is received on an SSL port. Both of these issues are only exploitable if the "UseCanonicalName" setting has been changed to "Off", and wildcard DNS is in use, and would allow remote attackers to execute scripts as other Web page visitors, for instance, to steal cookies. These issues affect Apache versions 1.3 to 1.3.26, and mod_ssl versions before 2.8.12. The Common Vulnerabilities and Exposures project has assigned the names CAN-2002-0840 and CAN-2002-1157 to these issues. The shared memory scoreboard in the HTTP daemon for Apache 1.3.x, prior to version 1.3.27, allowed a user running as the web server user to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or other such behavior that would not normally be allowed. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-839 to this issue. The mail function in PHP 4.x to 4.2.2 may allow local script authors to bypass safe mode restrictions and modify command line arguments to the MTA (such as Sendmail) in the fifth argument to mail(), altering MTA behavior and possibly executing arbitrary local commands. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0985 to this issue. The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy". The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0986 to this issue. Stronghold 4 contains Apache 1.3.22, mod_ssl 2.8.7, and PHP 4.1.2, and is therefore vulnerable to these issues. Users of Stronghold are advised to patch or upgrade their servers.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated versions of the Apache HTTP server, PHP, and mod_ssl are now\navailable which close possible buffer overflows in the Apache HTTP server\nbenchmarking tool, fixes two cross-site scripting vulnerabilities in the\nerror pages, and fix possible local privilege escalation.  These updates\nalso fix vulnerabilities in the PHP mail() function that allows script\nauthors to bypass safe mode restrictions, and possibly allow remote\nattackers to insert arbitrary mail headers and content into messages.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Apache HTTP server is a powerful, full-featured, efficient, and\nfreely-available Web server.  PHP is an HTML-embedded scripting language\ncommonly used with the Apache HTTP server.\n\nBuffer overflows in the ApacheBench support program (ab.c) in Apache\nversions prior to 1.3.27, allow a malicious Web server to cause a denial of\nservice and possibly execute arbitrary code via a long response.  The\nCommon Vulnerabilities and Exposures project has assigned the name\nCAN-2002-0843 to this issue.\n\nTwo cross-site scripting vulnerabilities are present in the error pages\nfor the default \"404 Not Found\" error, and for the error response when a\nplain HTTP request is received on an SSL port.  Both of these issues are\nonly exploitable if the \"UseCanonicalName\" setting has been changed to\n\"Off\", and wildcard DNS is in use, and would allow remote attackers\nto execute scripts as other Web page visitors, for instance, to steal\ncookies.  These issues affect Apache versions 1.3 to 1.3.26,\nand mod_ssl versions before 2.8.12.  The Common Vulnerabilities and\nExposures project has assigned the names CAN-2002-0840 and\nCAN-2002-1157 to these issues.\n\nThe shared memory scoreboard in the HTTP daemon for Apache 1.3.x, prior to\nversion 1.3.27, allowed a user running as the web server user to send a\nSIGUSR1 signal to any process as root, resulting in a denial of service\n(process kill) or other such behavior that would not normally be allowed. \nThe Common Vulnerabilities and Exposures project has assigned the name\nCAN-2002-839 to this issue.\n\nThe mail function in PHP 4.x to 4.2.2 may allow local script authors to\nbypass safe mode restrictions and modify command line arguments to the\nMTA (such as Sendmail) in the fifth argument to mail(), altering MTA\nbehavior and possibly executing arbitrary local commands. The Common\nVulnerabilities and Exposures project has assigned the name CAN-2002-0985\nto this issue.\n\nThe mail function in PHP 4.x to 4.2.2 does not filter ASCII control\ncharacters from its arguments, which could allow remote attackers to\nmodify mail message content, including mail headers, and possibly use\nPHP as a \"spam proxy\". The Common Vulnerabilities and Exposures project has\nassigned the name CAN-2002-0986 to this issue.\n\nStronghold 4 contains Apache 1.3.22, mod_ssl 2.8.7, and PHP 4.1.2, and\nis therefore vulnerable to these issues. Users of Stronghold are advised to\npatch or upgrade their servers.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:248",
        "url": "https://access.redhat.com/errata/RHSA-2002:248"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://www.apacheweek.com/issues/02-10-04",
        "url": "http://www.apacheweek.com/issues/02-10-04"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_248.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold",
    "tracking": {
      "current_release_date": "2024-11-21T22:31:28+00:00",
      "generator": {
        "date": "2024-11-21T22:31:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:248",
      "initial_release_date": "2002-11-07T17:42:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-07T17:42:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-10-07T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:31:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Stronghold 4 for Red Hat Enterprise Linux",
                "product": {
                  "name": "Stronghold 4 for Red Hat Enterprise Linux",
                  "product_id": "Stronghold 4 for Red Hat Enterprise Linux",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_stronghold:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold 4.0 for Red Hat Advanced Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-0839",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0839"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0839",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0839"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0839",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0839"
        }
      ],
      "release_date": "2002-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-07T17:42:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:248"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0840",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is \"Off\" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0840"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0840",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0840"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0840",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0840"
        }
      ],
      "release_date": "2002-10-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-07T17:42:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:248"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0843",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0843"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0843",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0843"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0843",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0843"
        }
      ],
      "release_date": "2002-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-07T17:42:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:248"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0985",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0985",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-07T17:42:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:248"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0986",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a \"spam proxy.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0986",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-07T17:42:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:248"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1157",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616849"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Stronghold 4 for Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1157"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616849",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1157",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1157"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1157",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1157"
        }
      ],
      "release_date": "2002-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-07T17:42:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Stronghold 4 for Red Hat Enterprise Linux"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:248"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    }
  ]
}

rhsa-2002:243

Vulnerability from csaf_redhat

Published

2002-11-08 11:15

Modified

2024-11-21 22:31

Summary

Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold

Notes

Topic

Details

The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP server. Buffer overflows in the ApacheBench support program (ab.c) in Apache versions prior to 1.3.27, allow a malicious Web server to cause a denial of service and possibly execute arbitrary code via a long response. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0843 to this issue. Two cross-site scripting vulnerabilities are present in the error pages for the default "404 Not Found" error, and for the error response when a plain HTTP request is received on an SSL port. Both of these issues are only exploitable if the "UseCanonicalName" setting has been changed to "Off", and wildcard DNS is in use, and would allow remote attackers to execute scripts as other Web page visitors, for instance, to steal cookies. These issues affect Apache versions 1.3 to 1.3.26, and mod_ssl versions before 2.8.12. The Common Vulnerabilities and Exposures project has assigned the names CAN-2002-0840 and CAN-2002-1157 to these issues. The shared memory scoreboard in the HTTP daemon for Apache 1.3.x, prior to version 1.3.27, allowed a user running as the web server user to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or other such behavior that would not normally be allowed. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-839 to this issue. The mail function in PHP 4.x to 4.2.2 may allow local script authors to bypass safe mode restrictions and modify command line arguments to the MTA (such as Sendmail) in the fifth argument to mail(), altering MTA behavior and possibly executing arbitrary local commands. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0985 to this issue. The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy". The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0986 to this issue. Stronghold contains Apache 1.3.22, mod_ssl 2.8.7, and PHP 4.1.2, and is therefore vulnerable to these issues. Users of Stronghold are advised to patch or upgrade their servers.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated versions of the Apache HTTP server, PHP, and mod_ssl are now\navailable which close possible buffer overflows in the Apache HTTP server\nbenchmarking tool, fixes two cross-site scripting vulnerabilities in the\nerror pages, and fix possible local privilege escalation.  These updates\nalso fix vulnerabilities in the PHP mail() function that allows script\nauthors to bypass safe mode restrictions, and possibly allow remote\nattackers to insert arbitrary mail headers and content into messages.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Apache HTTP server is a powerful, full-featured, efficient, and\nfreely-available Web server.  PHP is an HTML-embedded scripting language\ncommonly used with the Apache HTTP server.\n\nBuffer overflows in the ApacheBench support program (ab.c) in Apache\nversions prior to 1.3.27, allow a malicious Web server to cause a denial of\nservice and possibly execute arbitrary code via a long response.  The\nCommon Vulnerabilities and Exposures project has assigned the name\nCAN-2002-0843 to this issue.\n\nTwo cross-site scripting vulnerabilities are present in the error pages\nfor the default \"404 Not Found\" error, and for the error response when a\nplain HTTP request is received on an SSL port.  Both of these issues are\nonly exploitable if the \"UseCanonicalName\" setting has been changed to\n\"Off\", and wildcard DNS is in use, and would allow remote attackers\nto execute scripts as other Web page visitors, for instance, to steal\ncookies.  These issues affect Apache versions 1.3 to 1.3.26,\nand mod_ssl versions before 2.8.12.  The Common Vulnerabilities and\nExposures project has assigned the names CAN-2002-0840 and\nCAN-2002-1157 to these issues.\n\nThe shared memory scoreboard in the HTTP daemon for Apache 1.3.x, prior to\nversion 1.3.27, allowed a user running as the web server user to send a\nSIGUSR1 signal to any process as root, resulting in a denial of service\n(process kill) or other such behavior that would not normally be allowed. \nThe Common Vulnerabilities and Exposures project has assigned the name\nCAN-2002-839 to this issue.\n\nThe mail function in PHP 4.x to 4.2.2 may allow local script authors to\nbypass safe mode restrictions and modify command line arguments to the\nMTA (such as Sendmail) in the fifth argument to mail(), altering MTA\nbehavior and possibly executing arbitrary local commands. The Common\nVulnerabilities and Exposures project has assigned the name CAN-2002-0985\nto this issue.\n\nThe mail function in PHP 4.x to 4.2.2 does not filter ASCII control\ncharacters from its arguments, which could allow remote attackers to\nmodify mail message content, including mail headers, and possibly use\nPHP as a \"spam proxy\". The Common Vulnerabilities and Exposures project has\nassigned the name CAN-2002-0986 to this issue.\n\nStronghold contains Apache 1.3.22, mod_ssl 2.8.7, and PHP 4.1.2, and\nis therefore vulnerable to these issues. Users of Stronghold are advised to\npatch or upgrade their servers.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:243",
        "url": "https://access.redhat.com/errata/RHSA-2002:243"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://www.apacheweek.com/issues/02-10-04",
        "url": "http://www.apacheweek.com/issues/02-10-04"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_243.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold",
    "tracking": {
      "current_release_date": "2024-11-21T22:31:21+00:00",
      "generator": {
        "date": "2024-11-21T22:31:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:243",
      "initial_release_date": "2002-11-08T11:15:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-08T11:15:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-10-07T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:31:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Stronghold 3",
                "product": {
                  "name": "Red Hat Stronghold 3",
                  "product_id": "Red Hat Stronghold 3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:stronghold:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold Cross Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-0839",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0839"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0839",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0839"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0839",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0839"
        }
      ],
      "release_date": "2002-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0840",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is \"Off\" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0840"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0840",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0840"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0840",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0840"
        }
      ],
      "release_date": "2002-10-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0843",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0843"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0843",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0843"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0843",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0843"
        }
      ],
      "release_date": "2002-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0985",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0985",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0986",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a \"spam proxy.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0986",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1157",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616849"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1157"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616849",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1157",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1157"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1157",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1157"
        }
      ],
      "release_date": "2002-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    }
  ]
}

fkie_cve-2002-0985

Vulnerability from fkie_nvd

Published

2002-09-24 04:00

Modified

2025-04-03 01:03

Severity ?

Summary

References

URL	Tags
cve@mitre.org	ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt	Broken Link
cve@mitre.org	http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545	Broken Link
cve@mitre.org	http://marc.info/?l=bugtraq&m=103011916928204&w=2	Third Party Advisory
cve@mitre.org	http://marc.info/?l=bugtraq&m=105760591228031&w=2	Third Party Advisory
cve@mitre.org	http://www.debian.org/security/2002/dsa-168	Broken Link, Patch, Vendor Advisory
cve@mitre.org	http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082	Broken Link
cve@mitre.org	http://www.novell.com/linux/security/advisories/2002_036_modphp4.html	Broken Link
cve@mitre.org	http://www.osvdb.org/2111	Broken Link
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2002-213.html	Broken Link, Patch, Vendor Advisory
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2002-214.html	Broken Link
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2002-243.html	Broken Link
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2002-244.html	Broken Link
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2002-248.html	Broken Link
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2003-159.html	Broken Link
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/9966	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://marc.info/?l=bugtraq&m=103011916928204&w=2	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://marc.info/?l=bugtraq&m=105760591228031&w=2	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2002/dsa-168	Broken Link, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.novell.com/linux/security/advisories/2002_036_modphp4.html	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.osvdb.org/2111	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2002-213.html	Broken Link, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2002-214.html	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2002-243.html	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2002-244.html	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2002-248.html	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2003-159.html	Broken Link
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/9966	Third Party Advisory, VDB Entry

Impacted products

Vendor	Product	Version
php	php	*
openpkg	openpkg	1.1
openpkg	openpkg	1.2

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7CF9839-3A11-4934-B956-B590261FDAFC",
              "versionEndIncluding": "4.2.2",
              "versionStartIncluding": "4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openpkg:openpkg:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "85CCF640-211C-4EC0-9F41-68F5B39CA3F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6ADD463-E918-4F4D-9FA7-D109EBC98BD8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands."
    }
  ],
  "id": "CVE-2002-0985",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2002-09-24T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000545"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://marc.info/?l=bugtraq\u0026m=103011916928204\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://marc.info/?l=bugtraq\u0026m=105760591228031\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2002/dsa-168"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.novell.com/linux/security/advisories/2002_036_modphp4.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.osvdb.org/2111"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-213.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-214.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-243.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-244.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-248.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2003-159.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9966"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000545"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://marc.info/?l=bugtraq\u0026m=103011916928204\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://marc.info/?l=bugtraq\u0026m=105760591228031\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2002/dsa-168"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.novell.com/linux/security/advisories/2002_036_modphp4.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.osvdb.org/2111"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-213.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-214.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-243.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-244.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2002-248.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2003-159.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9966"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

ghsa-39rv-383r-32wp

Vulnerability from github

Published

2022-05-03 03:08

Modified

2022-05-03 03:08

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2002-0985"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2002-09-24T04:00:00Z",
    "severity": "HIGH"
  },
  "details": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.",
  "id": "GHSA-39rv-383r-32wp",
  "modified": "2022-05-03T03:08:03Z",
  "published": "2022-05-03T03:08:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9966"
    },
    {
      "type": "WEB",
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000545"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=103011916928204\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=105760591228031\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2002/dsa-168"
    },
    {
      "type": "WEB",
      "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/linux/security/advisories/2002_036_modphp4.html"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/2111"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-213.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-214.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-243.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-244.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2002-248.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2003-159.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

gsd-2002-0985

Vulnerability from gsd

Modified

2023-12-13 01:24

Details

Aliases

CVE-2002-0985

Aliases

CVE-2002-0985

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2002-0985",
    "description": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.",
    "id": "GSD-2002-0985",
    "references": [
      "https://www.debian.org/security/2002/dsa-168",
      "https://access.redhat.com/errata/RHSA-2003:159",
      "https://access.redhat.com/errata/RHSA-2002:248",
      "https://access.redhat.com/errata/RHSA-2002:244",
      "https://access.redhat.com/errata/RHSA-2002:243",
      "https://access.redhat.com/errata/RHSA-2002:214",
      "https://access.redhat.com/errata/RHSA-2002:213"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2002-0985"
      ],
      "details": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.",
      "id": "GSD-2002-0985",
      "modified": "2023-12-13T01:24:08.083141Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2002-0985",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "20030707 [OpenPKG-SA-2003.032] OpenPKG Security Advisory (php)",
            "refsource": "BUGTRAQ",
            "url": "http://marc.info/?l=bugtraq\u0026m=105760591228031\u0026w=2"
          },
          {
            "name": "DSA-168",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2002/dsa-168"
          },
          {
            "name": "php-mail-safemode-bypass(9966)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9966"
          },
          {
            "name": "20020823 PHP: Bypass safe_mode and inject ASCII control chars with mail()",
            "refsource": "BUGTRAQ",
            "url": "http://marc.info/?l=bugtraq\u0026m=103011916928204\u0026w=2"
          },
          {
            "name": "RHSA-2002:243",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2002-243.html"
          },
          {
            "name": "RHSA-2003:159",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2003-159.html"
          },
          {
            "name": "MDKSA-2003:082",
            "refsource": "MANDRAKE",
            "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082"
          },
          {
            "name": "CSSA-2003-008.0",
            "refsource": "CALDERA",
            "url": "ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt"
          },
          {
            "name": "SuSE-SA:2002:036",
            "refsource": "SUSE",
            "url": "http://www.novell.com/linux/security/advisories/2002_036_modphp4.html"
          },
          {
            "name": "CLA-2002:545",
            "refsource": "CONECTIVA",
            "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000545"
          },
          {
            "name": "RHSA-2002:213",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2002-213.html"
          },
          {
            "name": "RHSA-2002:248",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2002-248.html"
          },
          {
            "name": "RHSA-2002:244",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2002-244.html"
          },
          {
            "name": "2111",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/2111"
          },
          {
            "name": "RHSA-2002:214",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2002-214.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7CF9839-3A11-4934-B956-B590261FDAFC",
                    "versionEndIncluding": "4.2.2",
                    "versionStartIncluding": "4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:openpkg:openpkg:1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "85CCF640-211C-4EC0-9F41-68F5B39CA3F7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B6ADD463-E918-4F4D-9FA7-D109EBC98BD8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands."
          }
        ],
        "id": "CVE-2002-0985",
        "lastModified": "2024-02-13T18:00:37.773",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 7.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": true,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2002-09-24T04:00:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000545"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=103011916928204\u0026w=2"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=105760591228031\u0026w=2"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.debian.org/security/2002/dsa-168"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2002_036_modphp4.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://www.osvdb.org/2111"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2002-213.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2002-214.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2002-243.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2002-244.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2002-248.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Broken Link"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-159.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/9966"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-88"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2002-0985 (GCVE-0-2002-0985)

Vulnerability from cvelistv5

rhsa-2002:244

Vulnerability from csaf_redhat

rhsa-2003:159

Vulnerability from csaf_redhat

rhsa-2002:248

Vulnerability from csaf_redhat

rhsa-2002:243

Vulnerability from csaf_redhat

fkie_cve-2002-0985

Vulnerability from fkie_nvd

ghsa-39rv-383r-32wp

Vulnerability from github

gsd-2002-0985

Vulnerability from gsd

Tags

Sightings

Nomenclature