PHP NULL Character CVE-2015-2348 Incomplete Fix Security Bypass Vulnerability
BID:73434
Info
PHP NULL Character CVE-2015-2348 Incomplete Fix Security Bypass Vulnerability
| Bugtraq ID: | 73434 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-2348 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 30 2015 12:00AM |
| Updated: | Jul 06 2016 12:22PM |
| Credit: | djcapelis |
| Vulnerable: |
Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 PHP PHP 5.4.3 PHP PHP 5.4.2 PHP PHP 5.4.1 PHP PHP 5.5.0-DEV HP Virtual Connect Enterprise Manager 6.2 HP Virtual Connect Enterprise Manager 6.1 HP Virtual Connect Enterprise Manager 6.0 HP Version Control Agent 2.1.5 HP Systems Insight Manager 7.0 HP Systems Insight Manager 6.3 HP Systems Insight Manager 6.2 HP Systems Insight Manager 6.1 HP Systems Insight Manager 6.0 HP Systems Insight Manager 5.3 HP Systems Insight Manager 5.0 HP Systems Insight Manager 4.2 HP System Management Homepage 6.2.2 7 HP System Management Homepage 3.0.2 .77 HP System Management Homepage 3.0 .68 HP System Management Homepage 3.0 .64 HP System Management Homepage 2.2.9 .1 HP System Management Homepage 2.2.8 HP System Management Homepage 2.2.6 HP System Management Homepage 2.1.12 HP System Management Homepage 2.1.11 HP System Management Homepage 2.1.10 HP System Management Homepage 2.1.9 HP System Management Homepage 2.1.8 HP System Management Homepage 2.1.7 HP System Management Homepage 2.1.6 HP System Management Homepage 2.1.5 HP System Management Homepage 2.1.4 HP System Management Homepage 2.1.3 HP System Management Homepage 2.1.2 HP System Management Homepage 2.1.1 HP System Management Homepage 2.1 HP System Management Homepage 2.0.2 HP System Management Homepage 2.0.1 HP System Management Homepage 2.0 HP System Management Homepage 7.0 HP System Management Homepage 6.3 HP System Management Homepage 6.2 HP System Management Homepage 6.0 HP Insight Orchestration 6.2 HP Insight Orchestration 6.1 HP Insight Orchestration 6.0 Apple Mac Os X 10.7.4 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.1 |
| Not Vulnerable: | |
Discussion
PHP NULL Character CVE-2015-2348 Incomplete Fix Security Bypass Vulnerability
PHP is prone to a security-bypass vulnerability.
An attacker can leverage this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks.
A successful exploit could allow an attacker to access sensitive information.
Note: This issue is the result of an incomplete fix for the issue described in 44951 (PHP NULL Character Security Bypass Vulnerability).
PHP is prone to a security-bypass vulnerability.
An attacker can leverage this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks.
A successful exploit could allow an attacker to access sensitive information.
Note: This issue is the result of an incomplete fix for the issue described in 44951 (PHP NULL Character Security Bypass Vulnerability).
Exploit / POC
PHP NULL Character CVE-2015-2348 Incomplete Fix Security Bypass Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PHP NULL Character CVE-2015-2348 Incomplete Fix Security Bypass Vulnerability
References:
References:
- Fix bug #69207 - move_uploaded_file allows nulls in path (php)
- PHP Homepage (PHP)
- #69207 move_uploaded_file allows nulls in path (PHP)
- HP System Management Homepage (SMH) on Linux and Windows, Multiple Vulnerabiliti (HP)
- HPSBMU03396 rev.1 - HP Version Control Repository Manager (VCRM) on Windows and (Seclist)
- Oracle Linux Bulletin - January 2016 (Oracle)
- Security Advisory Important: php security and bug fix update (Redhat)