PHP up to 4.3.2 base64_encode /GD Library integer coercion

Summaryinfo

A vulnerability was found in PHP. It has been declared as critical. This issue affects some unknown processing of the component base64_encode /GD Library. Executing a manipulation can lead to integer coercion. This vulnerability is tracked as CVE-2003-0861. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in PHP (Programming Language Software) and classified as very critical. This vulnerability affects some unknown processing of the component base64_encode /GD Library. The manipulation with an unknown input leads to a integer coercion vulnerability. The CWE definition for the vulnerability is CWE-192. Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Integer overflows in (1) base64_encode and (2) the GD library for PHP before 4.3.3 have unknown impact and unknown attack vectors.

The weakness was disclosed 11/17/2003 (Website). The advisory is shared for download at php.net. This vulnerability was named CVE-2003-0861 since 10/10/2003. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/18/2024).

The vulnerability scanner Nessus provides a plugin with the ID 11850 (PHP < 4.3.3 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CGI abuses and running in the context r. The commercial vulnerability scanner Qualys is able to test this issue with plugin 11423 (PHP4 Multiple Vulnerabilities).

Upgrading to version 4.3.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (11850), SecurityFocus (BID 6488†) and Vulnerability Center (SBV-2226†). The entries VDB-20089, VDB-20991 and VDB-20994 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Name

• PHP

Version

• 4.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.1.0
• 4.1.1
• 4.1.2
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.3
• 4.3.1
• 4.3.2

License

• open-source

Website

• Product: https://www.php.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion