Vulnerability Description
Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 4.0, <= 4.2.2 |
| Openpkg | Openpkg | 1.1 |
Related Weaknesses (CWE)
References
- ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-008.0.txtBroken Link
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000545Broken Link
- http://marc.info/?l=bugtraq&m=103011916928204&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=105760591228031&w=2Third Party Advisory
- http://www.debian.org/security/2002/dsa-168Broken LinkPatchVendor Advisory
- http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:082Broken Link
- http://www.novell.com/linux/security/advisories/2002_036_modphp4.htmlBroken Link
- http://www.osvdb.org/2111Broken Link
- http://www.redhat.com/support/errata/RHSA-2002-213.htmlBroken LinkPatchVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2002-214.htmlBroken Link
- http://www.redhat.com/support/errata/RHSA-2002-243.htmlBroken Link
- http://www.redhat.com/support/errata/RHSA-2002-244.htmlBroken Link
- http://www.redhat.com/support/errata/RHSA-2002-248.htmlBroken Link
- http://www.redhat.com/support/errata/RHSA-2003-159.htmlBroken Link
- https://exchange.xforce.ibmcloud.com/vulnerabilities/9966Third Party AdvisoryVDB Entry
FAQ
What is CVE-2002-0985?
CVE-2002-0985 is a vulnerability with a CVSS score of 7.5 (HIGH). Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th ...
How severe is CVE-2002-0985?
CVE-2002-0985 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2002-0985?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Openpkg Openpkg.