Vulnerability Details : CVE-2010-3436
fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.
Threat overview for CVE-2010-3436
Top countries where our scanners detected CVE-2010-3436
Top open port discovered on systems with this issue
80
IPs affected by CVE-2010-3436 61,601
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2010-3436!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2010-3436
Probability of exploitation activity in the next 30 days: 0.56%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 75 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-3436
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2010-3436
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-3436
-
http://support.apple.com/kb/HT4581
About the security content of Mac OS X v10.6.7 and Security Update 2011-001 - Apple SupportThird Party Advisory
-
http://svn.php.net/viewvc?view=revision&revision=303824
PHP: Revision 303824Patch;Vendor Advisory
-
http://www.php.net/archive/2010.php#id2010-12-10-1
PHP: News Archive - 2010Vendor Advisory
-
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
Apple - Lists.apple.comMailing List;Third Party Advisory
-
http://www.vupen.com/english/advisories/2010/3313
Webmail | OVH- OVHPermissions Required
-
http://svn.php.net/viewvc/php/php-src/trunk/main/fopen_wrappers.c?r1=303824&r2=303823&pathrev=303824
PHP: Diff of /php/php-src/trunk/main/fopen_wrappers.cPatch;Vendor Advisory
-
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
Apple - Lists.apple.comMailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/44723
PHP 'open_basedir' Security-Bypass VulnerabilityThird Party Advisory;VDB Entry
-
http://www.php.net/releases/5_3_4.php
PHP: PHP 5.3.4 Release AnnouncementVendor Advisory
-
http://www.mandriva.com/security/advisories?name=MDVSA-2010:218
mandriva.comThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1042-1
USN-1042-1: PHP vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.php.net/releases/5_2_15.php
PHP: PHP 5.2.15 Release AnnouncementVendor Advisory
-
http://www.php.net/ChangeLog-5.php
PHP: PHP 5 ChangeLogVendor Advisory
-
http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.490619
The Slackware Linux Project: Slackware Security AdvisoriesThird Party Advisory
-
http://www.vupen.com/english/advisories/2011/0077
Webmail | OVH- OVHPermissions Required
-
http://security-tracker.debian.org/tracker/CVE-2010-3436
CVE-2010-3436Third Party Advisory
-
http://support.apple.com/kb/HT5002
About the security content of OS X Lion v10.7.2 and Security Update 2011-006 - Apple SupportThird Party Advisory
Products affected by CVE-2010-3436
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*