ByteOS Network

CVE Vulnerability Details :

CVE-2009-4017

PUBLISHED

More Info Official Page

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-24 Nov, 2009 | 00:00

Updated At-07 Aug, 2024 | 06:45

▼CVE Numbering Authority (CNA)

PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6667	vdb-entry signature x_refsource_OVAL
http://www.php.net/releases/5_2_12.php	x_refsource_CONFIRM
http://secunia.com/advisories/37482	third-party-advisory x_refsource_SECUNIA
http://secunia.com/advisories/40262	third-party-advisory x_refsource_SECUNIA
http://news.php.net/php.announce/79	mailing-list x_refsource_MLIST
http://marc.info/?l=bugtraq&m=127680701405735&w=2	vendor-advisory x_refsource_HP
http://www.mandriva.com/security/advisories?name=MDVSA-2009:305	vendor-advisory x_refsource_MANDRIVA
http://secunia.com/advisories/37821	third-party-advisory x_refsource_SECUNIA
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	vendor-advisory x_refsource_APPLE
http://www.securityfocus.com/archive/1/507982/100/0/threaded	mailing-list x_refsource_BUGTRAQ
http://secunia.com/advisories/41490	third-party-advisory x_refsource_SECUNIA
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995	vendor-advisory x_refsource_HP
http://www.acunetix.com/blog/websecuritynews/php-multipartform-data-denial-of-service/	x_refsource_MISC
http://www.debian.org/security/2009/dsa-1940	vendor-advisory x_refsource_DEBIAN
http://www.php.net/ChangeLog-5.php	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2009/11/20/7	mailing-list x_refsource_MLIST
http://support.apple.com/kb/HT4077	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2009/11/20/2	mailing-list x_refsource_MLIST
http://www.php.net/releases/5_3_1.php	x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2009/3593	vdb-entry x_refsource_VUPEN
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10483	vdb-entry signature x_refsource_OVAL
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995	vendor-advisory x_refsource_HP
http://secunia.com/advisories/41480	third-party-advisory x_refsource_SECUNIA
http://marc.info/?l=bugtraq&m=127680701405735&w=2	vendor-advisory x_refsource_HP
http://seclists.org/fulldisclosure/2009/Nov/228	mailing-list x_refsource_FULLDISC
http://www.mandriva.com/security/advisories?name=MDVSA-2009:303	vendor-advisory x_refsource_MANDRIVA
https://exchange.xforce.ibmcloud.com/vulnerabilities/54455	vdb-entry x_refsource_XF

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6667

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://www.php.net/releases/5_2_12.php

Resource:

x_refsource_CONFIRM

Hyperlink: http://secunia.com/advisories/37482

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://secunia.com/advisories/40262

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://news.php.net/php.announce/79

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://marc.info/?l=bugtraq&m=127680701405735&w=2

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2009:305

Resource:

vendor-advisory

x_refsource_MANDRIVA

Hyperlink: http://secunia.com/advisories/37821

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Resource:

vendor-advisory

x_refsource_APPLE

Hyperlink: http://www.securityfocus.com/archive/1/507982/100/0/threaded

Resource:

mailing-list

x_refsource_BUGTRAQ

Hyperlink: http://secunia.com/advisories/41490

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: http://www.acunetix.com/blog/websecuritynews/php-multipartform-data-denial-of-service/

Resource:

x_refsource_MISC

Hyperlink: http://www.debian.org/security/2009/dsa-1940

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: http://www.php.net/ChangeLog-5.php

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.openwall.com/lists/oss-security/2009/11/20/7

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://support.apple.com/kb/HT4077

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.openwall.com/lists/oss-security/2009/11/20/2

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://www.php.net/releases/5_3_1.php

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.vupen.com/english/advisories/2009/3593

Resource:

vdb-entry

x_refsource_VUPEN

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10483

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: http://secunia.com/advisories/41480

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://marc.info/?l=bugtraq&m=127680701405735&w=2

Resource:

vendor-advisory

x_refsource_HP

Hyperlink: http://seclists.org/fulldisclosure/2009/Nov/228

Resource:

mailing-list

x_refsource_FULLDISC

Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2009:303

Resource:

vendor-advisory

x_refsource_MANDRIVA

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/54455

Resource:

vdb-entry

x_refsource_XF

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6667	vdb-entry signature x_refsource_OVAL x_transferred
http://www.php.net/releases/5_2_12.php	x_refsource_CONFIRM x_transferred
http://secunia.com/advisories/37482	third-party-advisory x_refsource_SECUNIA x_transferred
http://secunia.com/advisories/40262	third-party-advisory x_refsource_SECUNIA x_transferred
http://news.php.net/php.announce/79	mailing-list x_refsource_MLIST x_transferred
http://marc.info/?l=bugtraq&m=127680701405735&w=2	vendor-advisory x_refsource_HP x_transferred
http://www.mandriva.com/security/advisories?name=MDVSA-2009:305	vendor-advisory x_refsource_MANDRIVA x_transferred
http://secunia.com/advisories/37821	third-party-advisory x_refsource_SECUNIA x_transferred
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	vendor-advisory x_refsource_APPLE x_transferred
http://www.securityfocus.com/archive/1/507982/100/0/threaded	mailing-list x_refsource_BUGTRAQ x_transferred
http://secunia.com/advisories/41490	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995	vendor-advisory x_refsource_HP x_transferred
http://www.acunetix.com/blog/websecuritynews/php-multipartform-data-denial-of-service/	x_refsource_MISC x_transferred
http://www.debian.org/security/2009/dsa-1940	vendor-advisory x_refsource_DEBIAN x_transferred
http://www.php.net/ChangeLog-5.php	x_refsource_CONFIRM x_transferred
http://www.openwall.com/lists/oss-security/2009/11/20/7	mailing-list x_refsource_MLIST x_transferred
http://support.apple.com/kb/HT4077	x_refsource_CONFIRM x_transferred
http://www.openwall.com/lists/oss-security/2009/11/20/2	mailing-list x_refsource_MLIST x_transferred
http://www.php.net/releases/5_3_1.php	x_refsource_CONFIRM x_transferred
http://www.vupen.com/english/advisories/2009/3593	vdb-entry x_refsource_VUPEN x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10483	vdb-entry signature x_refsource_OVAL x_transferred
http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995	vendor-advisory x_refsource_HP x_transferred
http://secunia.com/advisories/41480	third-party-advisory x_refsource_SECUNIA x_transferred
http://marc.info/?l=bugtraq&m=127680701405735&w=2	vendor-advisory x_refsource_HP x_transferred
http://seclists.org/fulldisclosure/2009/Nov/228	mailing-list x_refsource_FULLDISC x_transferred
http://www.mandriva.com/security/advisories?name=MDVSA-2009:303	vendor-advisory x_refsource_MANDRIVA x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/54455	vdb-entry x_refsource_XF x_transferred