National Vulnerability Database (NVD) National Vulnerability Database (CVE-2008-5557)

National Cyber-Alert System

Vulnerability Summary for CVE-2008-5557

Original release date:12/23/2008

Last revised:07/15/2009

Source: US-CERT/NIST

Overview

Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C) (legend)

Impact Subscore: 10.0

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA09-133A

Name: TA09-133A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-133A.html

External Source: FEDORA

Name: FEDORA-2009-3848

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html

External Source: FEDORA

Name: FEDORA-2009-3768

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html

External Source: XF

Name: php-multibyte-bo(47525)

Hyperlink:http://xforce.iss.net/xforce/xfdb/47525

External Source: VUPEN

Name: ADV-2009-1297

Hyperlink:http://www.vupen.com/english/advisories/2009/1297

External Source: BID

Name: 32948

Hyperlink:http://www.securityfocus.com/bid/32948

External Source: BUGTRAQ

Name: 20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/501376/100/0/threaded

External Source: REDHAT

Name: RHSA-2009:0350

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-0350.html

External Source: CONFIRM

Name: http://www.php.net/ChangeLog-5.php#5.2.7

Hyperlink:http://www.php.net/ChangeLog-5.php#5.2.7

External Source: MANDRIVA

Name: MDVSA-2009:045

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:045

External Source: DEBIAN

Name: DSA-1789

Hyperlink:http://www.debian.org/security/2009/dsa-1789

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2009-0035

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2009-0035

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3549

Hyperlink:http://support.apple.com/kb/HT3549

External Source: SECTRACK

Name: 1021482

Hyperlink:http://securitytracker.com/id?1021482

External Source: SECUNIA

Name: 35650

Hyperlink:http://secunia.com/advisories/35650

External Source: SECUNIA

Name: 35306

Hyperlink:http://secunia.com/advisories/35306

External Source: SECUNIA

Name: 35074

Hyperlink:http://secunia.com/advisories/35074

External Source: SECUNIA

Name: 35003

Hyperlink:http://secunia.com/advisories/35003

External Source: SECUNIA

Name: 34642

Hyperlink:http://secunia.com/advisories/34642

External Source: HP

Name: HPSBUX02431

Hyperlink:http://marc.info/?l=bugtraq&m=124654546101607&w=2

External Source: HP

Name: HPSBUX02431

Hyperlink:http://marc.info/?l=bugtraq&m=124654546101607&w=2

External Source: SUSE

Name: SUSE-SR:2009:008

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

External Source: SUSE

Name: SUSE-SR:2009:004

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

External Source: APPLE

Name: APPLE-SA-2009-05-12

Hyperlink:http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

External Source: CONFIRM

Name: http://cvs.php.net/viewvc.cgi/php-src/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c?r1=1.7&r2=1.8

Hyperlink:http://cvs.php.net/viewvc.cgi/php-src/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c?r1=1.7&r2=1.8

External Source: CONFIRM

Name: http://bugs.php.net/bug.php?id=45722

Hyperlink:http://bugs.php.net/bug.php?id=45722

External Source: FULLDISC

Name: 20081221 CVE-2008-5557 - PHP mbstring buffer overflow

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0477.html

Vulnerable software and versions

Configuration 1

* cpe:/a:php:php:4.3.1

* cpe:/a:php:php:4.3.0

* cpe:/a:php:php:4.3.2

* cpe:/a:php:php:4.3.3

* cpe:/a:php:php:4.3.4

* cpe:/a:php:php:4.3.5

* cpe:/a:php:php:4.3.6

* cpe:/a:php:php:4.3.7

* cpe:/a:php:php:4.3.8

* cpe:/a:php:php:4.3.9

* cpe:/a:php:php:4.3.10

* cpe:/a:php:php:4.3.11

* cpe:/a:php:php:4.4.0

* cpe:/a:php:php:4.4.5

* cpe:/a:php:php:4.4.6

* cpe:/a:php:php:4.4.7

* cpe:/a:php:php:4.4.8

* cpe:/a:php:php:4.4.9

* cpe:/a:php:php:4.4.1

* cpe:/a:php:php:4.4.2

* cpe:/a:php:php:4.4.3

* cpe:/a:php:php:4.4.4

* cpe:/a:php:php:5.0.0:beta1

* cpe:/a:php:php:5.0.0:beta2

* cpe:/a:php:php:5.0.0:beta3

* cpe:/a:php:php:5.0.0:beta4

* cpe:/a:php:php:5.0.0:rc1

* cpe:/a:php:php:5.0.0:rc2

* cpe:/a:php:php:5.0.0:rc3

* cpe:/a:php:php:5.0.0

* cpe:/a:php:php:5.0.1

* cpe:/a:php:php:5.0.2

* cpe:/a:php:php:5.0.3

* cpe:/a:php:php:5.0.4

* cpe:/a:php:php:5.0.5

* cpe:/a:php:php:5.1.0

* cpe:/a:php:php:5.1.1

* cpe:/a:php:php:5.1.2

* cpe:/a:php:php:5.1.3

* cpe:/a:php:php:5.1.4

* cpe:/a:php:php:5.1.5

* cpe:/a:php:php:5.1.6

* cpe:/a:php:php:5.2.0

* cpe:/a:php:php:5.2.1

* cpe:/a:php:php:5.2.2

* cpe:/a:php:php:5.2.3

* cpe:/a:php:php:5.2.4

* cpe:/a:php:php:5.2.5

* cpe:/a:php:php:5.2.6

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Buffer Errors (CWE-119)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557