critical10.0Public exploit code
CVE-2000-0967
PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHP 3.0/4.0 - Error Logging Format String2000-10-12 · remote · php · Verified
- PHP 3.0.16/4.0.2 - Remote Format Overflow2000-12-06 · remote · linux · Verified
Impact
PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php | Php | Versions 3.0, 4.0 |
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2000-10/0204.html
- http://www.atstake.com/research/advisories/2000/a101200-1.txt
- http://www.calderasystems.com/support/security/advisories/CSSA-2000-037.0.txt
- http://www.linux-mandrake.com/en/security/MDKSA-2000-062.php3?dis=7.1
- http://www.redhat.com/support/errata/RHSA-2000-088.html
- http://www.redhat.com/support/errata/RHSA-2000-095.html
- http://www.securityfocus.com/bid/1786
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5359
- http://archives.neohapsis.com/archives/bugtraq/2000-10/0204.html
- http://www.atstake.com/research/advisories/2000/a101200-1.txt
- http://www.calderasystems.com/support/security/advisories/CSSA-2000-037.0.txt
- http://www.linux-mandrake.com/en/security/MDKSA-2000-062.php3?dis=7.1
- http://www.redhat.com/support/errata/RHSA-2000-088.html
- http://www.redhat.com/support/errata/RHSA-2000-095.html
- http://www.securityfocus.com/bid/1786
- https://exchange.xforce.ibmcloud.com/vulnerabilities/5359