Vulnerability Details : CVE-2008-3660
PHP 4.4.x before 4.4.9, and 5.x through 5.2.6, when used as a FastCGI module, allows remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using foo..php.
Vulnerability category: Input validationDenial of service
Threat overview for CVE-2008-3660
Top countries where our scanners detected CVE-2008-3660
Top open port discovered on systems with this issue
80
IPs affected by CVE-2008-3660 16,908
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2008-3660!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2008-3660
Probability of exploitation activity in the next 30 days: 4.80%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 92 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-3660
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2008-3660
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-3660
-
http://www.vupen.com/english/advisories/2009/1297
Webmail: access your OVH emails on ovhcloud.com | OVHcloud
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/44402
- http://www.openwall.com/lists/oss-security/2008/08/13/8
-
http://marc.info/?l=bugtraq&m=124654546101607&w=2
'[security bulletin] HPSBUX02431 SSRT090085 rev.1 - HP-UX Running Apache Web Server Suite, Remote Den' - MARC
- http://www.debian.org/security/2008/dsa-1647
-
http://marc.info/?l=bugtraq&m=125631037611762&w=2
'[security bulletin] HPSBUX02465 SSRT090192 rev.1 - HP-UX Running Apache-based Web Server, Remote Den' - MARC
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html
- http://www.vupen.com/english/advisories/2008/2336
- http://www.openwall.com/lists/oss-security/2008/08/08/2
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
- http://wiki.rpath.com/Advisories:rPSA-2009-0035
-
http://security.gentoo.org/glsa/glsa-200811-05.xml
PHP: Multiple vulnerabilities (GLSA 200811-05) — Gentoo security
- http://www.redhat.com/support/errata/RHSA-2009-0350.html
- http://www.securityfocus.com/archive/1/501376/100/0/threaded
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:024
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:021
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:022
-
http://www.securitytracker.com/id?1020994
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html
-
http://support.apple.com/kb/HT3549
About the security content of Security Update 2009-002 / Mac OS X v10.5.7 - Apple Support
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:023
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9597
-
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
Apple Updates for Multiple Vulnerabilities | CISAUS Government Resource
-
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2008:018 - openSUSE Security Announce - openSUSE Mailing Lists
- http://bugs.gentoo.org/show_bug.cgi?id=234102
Products affected by CVE-2008-3660
- cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*