CVE-2002-0985
CVSS7.5
发布时间 :2002-09-24 00:00:00
修订时间 :2016-10-17 22:23:17
NMCO    

[原文]Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.


[CNNVD]PHP mail函数注入ASCII控制字符欺骗mail头信息漏洞(CNNVD-200209-031)

        
        PHP是一种流行的WEB服务器端编程语言,它功能强大,简单易用,在很多Unix操作系统默认都安装了PHP, 它也可以在Windows系统下运行。
        PHP的mail函数没有很好的过滤用户的输入,远程攻击者可能利用此漏洞修改邮件头信息。
        PHP的mail函数没有很好的过滤用户输入的邮件字符串变量,导致用户输入的ASCII控制字符可以修改邮件信息,包括邮件头信息。
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:php:php:4.0.1PHP PHP 4.0.1
cpe:/a:php:php:4.1.0PHP PHP 4.1.0
cpe:/a:php:php:4.0.3PHP PHP 4.0.3
cpe:/a:php:php:4.1.2PHP PHP 4.1.2
cpe:/a:php:php:4.2.1PHP PHP 4.2.1
cpe:/a:php:php:4.0.2PHP PHP 4.0.2
cpe:/a:php:php:4.1.1PHP PHP 4.1.1
cpe:/a:php:php:4.2.0PHP PHP 4.2.0
cpe:/a:php:php:3.0.18PHP PHP 3.0.18
cpe:/a:php:php:4.0.1:patch1
cpe:/a:php:php:4.0.3:patch1
cpe:/a:php:php:4.0
cpe:/a:php:php:4.0.1:patch2
cpe:/a:php:php:4.0.5PHP PHP 4.0.5
cpe:/a:php:php:4.0.4PHP PHP 4.0.4
cpe:/a:php:php:4.2.2PHP PHP 4.2.2
cpe:/a:php:php:4.0.7PHP PHP 4.0.7
cpe:/a:php:php:4.0.6PHP PHP 4.0.6

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0985
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0985
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200209-031
(官方数据源) CNNVD

- 其它链接及资源

ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txt
(UNKNOWN)  CALDERA  CSSA-2003-008.0
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545
(UNKNOWN)  CONECTIVA  CLA-2002:545
http://marc.info/?l=bugtraq&m=103011916928204&w=2
(UNKNOWN)  BUGTRAQ  20020823 PHP: Bypass safe_mode and inject ASCII control chars with mail()
http://marc.info/?l=bugtraq&m=105760591228031&w=2
(UNKNOWN)  BUGTRAQ  20030707 [OpenPKG-SA-2003.032] OpenPKG Security Advisory (php)
http://www.debian.org/security/2002/dsa-168
(VENDOR_ADVISORY)  DEBIAN  DSA-168
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082
(UNKNOWN)  MANDRAKE  MDKSA-2003:082
http://www.novell.com/linux/security/advisories/2002_036_modphp4.html
(UNKNOWN)  SUSE  SuSE-SA:2002:036
http://www.redhat.com/support/errata/RHSA-2002-213.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2002:213
http://www.redhat.com/support/errata/RHSA-2002-214.html
(UNKNOWN)  REDHAT  RHSA-2002:214
http://www.redhat.com/support/errata/RHSA-2002-243.html
(UNKNOWN)  REDHAT  RHSA-2002:243
http://www.redhat.com/support/errata/RHSA-2002-244.html
(UNKNOWN)  REDHAT  RHSA-2002:244
http://www.redhat.com/support/errata/RHSA-2002-248.html
(UNKNOWN)  REDHAT  RHSA-2002:248
http://www.redhat.com/support/errata/RHSA-2003-159.html
(UNKNOWN)  REDHAT  RHSA-2003:159
http://xforce.iss.net/xforce/xfdb/9966
(VENDOR_ADVISORY)  XF  php-mail-safemode-bypass(9966)

- 漏洞信息

PHP mail函数注入ASCII控制字符欺骗mail头信息漏洞
高危 未知
2002-09-24 00:00:00 2005-05-13 00:00:00
远程  
        
        PHP是一种流行的WEB服务器端编程语言,它功能强大,简单易用,在很多Unix操作系统默认都安装了PHP, 它也可以在Windows系统下运行。
        PHP的mail函数没有很好的过滤用户的输入,远程攻击者可能利用此漏洞修改邮件头信息。
        PHP的mail函数没有很好的过滤用户输入的邮件字符串变量,导致用户输入的ASCII控制字符可以修改邮件信息,包括邮件头信息。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 在书写php脚本的时候过滤用户提交的特殊字符,只允许标准的email。
        厂商补丁:
        PHP
        ---
        目前各家厂商已经提供了补丁或者升级程序:
        RedHat就此漏洞发布了安全公告RHSA-2002:213-06。
        Gentoo Linux建议使用dev-php/php-4.2.2-r1、dev-php/mod_php-4.2.2-r1及其以前版本的用户按照如下步骤升级系统:
         emerge rsync
         emerge php
         and/or
         emerge mod_php
         emerge clean
        补丁下载:
        
        PHP PHP 3.0 .18:
        Debian Upgrade php3-cgi_3.0.18-23.1woody1_sparc.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_sparc.deb

        Debian Upgrade php3_3.0.18-23.1woody1_sparc.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_sparc.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_s390.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_s390.deb

        Debian Upgrade php3_3.0.18-23.1woody1_s390.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_s390.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_powerpc.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_powerpc.deb

        Debian Upgrade php3_3.0.18-23.1woody1_powerpc.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_powerpc.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_mipsel.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_mipsel.deb

        Debian Upgrade php3_3.0.18-23.1woody1_mipsel.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_mipsel.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_mips.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_mips.deb

        Debian Upgrade php3_3.0.18-23.1woody1_mips.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_mips.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_m68k.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_m68k.deb

        Debian Upgrade php3_3.0.18-23.1woody1_m68k.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_m68k.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_hppa.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_hppa.deb

        Debian Upgrade php3_3.0.18-23.1woody1_hppa.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_hppa.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_ia64.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_ia64.deb

        Debian Upgrade php3_3.0.18-23.1woody1_ia64.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_ia64.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_i386.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_i386.deb

        Debian Upgrade php3_3.0.18-23.1woody1_i386.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_i386.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_arm.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_arm.deb

        Debian Upgrade php3_3.0.18-23.1woody1_arm.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_arm.deb

        Debian Upgrade php3-cgi_3.0.18-23.1woody1_alpha.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-23.1woody1_alpha.deb

        Debian Upgrade php3_3.0.18-23.1woody1_alpha.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-23.1woody1_alpha.deb

        Debian Upgrade php3-cgi_3.0.18-0potato1.2_sparc.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-0potato1.2_sparc.deb

        Debian Upgrade php3_3.0.18-0potato1.2_sparc.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-0potato1.2_sparc.deb

        Debian Upgrade php3-cgi_3.0.18-0potato1.2_powerpc.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-0potato1.2_powerpc.deb

        Debian Upgrade php3_3.0.18-0potato1.2_powerpc.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-0potato1.2_powerpc.deb

        Debian Upgrade php3-cgi_3.0.18-0potato1.2_m68k.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-0potato1.2_m68k.deb

        Debian Upgrade php3_3.0.18-0potato1.2_m68k.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-0potato1.2_m68k.deb

        Debian Upgrade php3-cgi_3.0.18-0potato1.2_i386.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3-cgi_3.0.18-0potato1.2_i386.deb

        Debian Upgrade php3_3.0.18-0potato1.2_i386.deb
        
        http://security.debian.org/pool/updates/main/p/php3/php3_3.0.18-0potato1.2_i386.deb

        Debian Upgrade

- 漏洞信息

2111
PHP Mail Function ASCII Control Character Header Spoofing

- 漏洞描述

PHP 4.x to 4.2.2 contains a flaw that exist in the mail() function that does not properly sanitize user input. It is possible for a user may pass ASCII control characters to the mail() function that could alter the headers of email. This could result in spoofed mail headers.

- 时间线

2003-07-30 2002-08-23
2003-07-30 Unknow

- 解决方案

Upgrade to the latest version of PHP available, or disable the mail() function in the php.ini.

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站