ByteOS Network

NVD Vulnerability Details :

CVE-2004-1064

Deferred

Source-cve@mitre.org

Published At-10 Jan, 2005 | 05:00

Updated At-03 Apr, 2025 | 01:03

The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

The PHP Group

>>php>>Versions from 4.0.0(inclusive) to 4.3.9(inclusive)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

The PHP Group

>>php>>Versions from 5.0.0(inclusive) to 5.0.2(inclusive)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>4.10

cpe:2.3:o:canonical:ubuntu_linux:4.10:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

Vendor Statements

Organization : Red Hat

Last Modified : 2008-10-30T00:00:00

We do not consider safe_mode / open_basedir restriction bypass issues being security sensitive. For more details see http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php

References

Hyperlink	Source	Resource
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915	cve@mitre.org	Broken Link
http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml	cve@mitre.org	Third Party Advisory
http://www.hardened-php.net/advisories/012004.txt	cve@mitre.org	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:151	cve@mitre.org	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:072	cve@mitre.org	Third Party Advisory
http://www.php.net/release_4_3_10.php	cve@mitre.org	Release Notes Vendor Advisory
http://www.securityfocus.com/advisories/9028	cve@mitre.org	Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/384545	cve@mitre.org	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/11964	cve@mitre.org	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/18512	cve@mitre.org	Third Party Advisory VDB Entry
https://www.ubuntu.com/usn/usn-99-1/	cve@mitre.org	Third Party Advisory
https://www.ubuntu.com/usn/usn-99-2/	cve@mitre.org	Third Party Advisory
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.hardened-php.net/advisories/012004.txt	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:151	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:072	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.php.net/release_4_3_10.php	af854a3a-2127-422b-91ae-364da2661108	Release Notes Vendor Advisory
http://www.securityfocus.com/advisories/9028	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/384545	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/11964	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/18512	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://www.ubuntu.com/usn/usn-99-1/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.ubuntu.com/usn/usn-99-2/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History