PHP up to 7.2.25/7.3.12 Filename DirectoryIterator Null Byte null termination

Summaryinfo

A vulnerability was found in PHP up to 7.2.25/7.3.12 and classified as critical. Impacted is the function DirectoryIterator of the component Filename Handler. Executing a manipulation as part of Null Byte can lead to null termination. This vulnerability is tracked as CVE-2019-11045. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in PHP up to 7.2.25/7.3.12 (Programming Language Software). This vulnerability affects the function DirectoryIterator of the component Filename Handler. The manipulation as part of a Null Byte leads to a null termination vulnerability. The CWE definition for the vulnerability is CWE-170. The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

The weakness was disclosed 12/23/2019. This vulnerability was named CVE-2019-11045 since 04/09/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 7.2.26, 7.3.13 or 7.4.0 eliminates this vulnerability.

The entries VDB-147596, VDB-147595, VDB-147594 and VDB-147593 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Name

• PHP

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.2.10
• 7.2.11
• 7.2.12
• 7.2.13
• 7.2.14
• 7.2.15
• 7.2.16
• 7.2.17
• 7.2.18
• 7.2.19
• 7.2.20
• 7.2.21
• 7.2.22
• 7.2.23
• 7.2.24
• 7.2.25
• 7.3.0
• 7.3.1
• 7.3.2
• 7.3.3
• 7.3.4
• 7.3.5
• 7.3.6
• 7.3.7
• 7.3.8
• 7.3.9
• 7.3.10
• 7.3.11
• 7.3.12

License

• open-source

Website

• Product: https://www.php.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion