CVE-2008-0145 - Vulnerability Details - OpenCVE

Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors. NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Php	Php

Configuration 1 [-]

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://bugs.php.net/bug.php?id=41655
http://secunia.com/advisories/28318
http://secunia.com/advisories/28936
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136
http://www.php.net/ChangeLog-4.php
http://www.php.net/releases/4_4_8.php
http://www.vupen.com/english/advisories/2008/0059
https://exchange.xforce.ibmcloud.com/vulnerabilities/39401

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-01-08T19:00:00

Updated: 2024-08-07T07:32:24.201Z

Reserved: 2008-01-08T00:00:00

Link: CVE-2008-0145

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2008-01-08T19:46:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-0145

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-01-03T00:00:00", "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors. NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-07T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2008-0059", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/0059"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.php.net/releases/4_4_8.php"}, {"name": "SSA:2008-045-03", "tags": ["vendor-advisory", "x_refsource_SLACKWARE"], "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136"}, {"name": "28936", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/28936"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.php.net/bug.php?id=41655"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.php.net/ChangeLog-4.php"}, {"name": "28318", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/28318"}, {"name": "php-glob-openbasedir-security-bypass(39401)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39401"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-0145", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors. NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2008-0059", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/0059"}, {"name": "http://www.php.net/releases/4_4_8.php", "refsource": "CONFIRM", "url": "http://www.php.net/releases/4_4_8.php"}, {"name": "SSA:2008-045-03", "refsource": "SLACKWARE", "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136"}, {"name": "28936", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/28936"}, {"name": "http://bugs.php.net/bug.php?id=41655", "refsource": "CONFIRM", "url": "http://bugs.php.net/bug.php?id=41655"}, {"name": "http://www.php.net/ChangeLog-4.php", "refsource": "CONFIRM", "url": "http://www.php.net/ChangeLog-4.php"}, {"name": "28318", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/28318"}, {"name": "php-glob-openbasedir-security-bypass(39401)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39401"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T07:32:24.201Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2008-0059", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/0059"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.php.net/releases/4_4_8.php"}, {"name": "SSA:2008-045-03", "tags": ["vendor-advisory", "x_refsource_SLACKWARE", "x_transferred"], "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136"}, {"name": "28936", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/28936"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.php.net/bug.php?id=41655"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.php.net/ChangeLog-4.php"}, {"name": "28318", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/28318"}, {"name": "php-glob-openbasedir-security-bypass(39401)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39401"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-0145", "datePublished": "2008-01-08T19:00:00", "dateReserved": "2008-01-08T00:00:00", "dateUpdated": "2024-08-07T07:32:24.201Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "25A322B4-9EBB-449F-A678-33BAD936A606", "versionEndIncluding": "4.4.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors. NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663."}, {"lang": "es", "value": "Vulnerabilidad no especificada en glob de PHP versiones anteriores a 4.4.8, cuando open_basedir est\u00e1 habilitado, tiene impacto desconocido y vectores de ataque.\r\nNOTA: esta vulnerabilidad existe debido a una regresi\u00f3n relativa a CVE-2007-4663."}], "id": "CVE-2008-0145", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-01-08T19:46:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://bugs.php.net/bug.php?id=41655"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/28318"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/28936"}, {"source": "cve@mitre.org", "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136"}, {"source": "cve@mitre.org", "url": "http://www.php.net/ChangeLog-4.php"}, {"source": "cve@mitre.org", "url": "http://www.php.net/releases/4_4_8.php"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/0059"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39401"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://bugs.php.net/bug.php?id=41655"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/28318"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/28936"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.php.net/ChangeLog-4.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.php.net/releases/4_4_8.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2008/0059"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39401"}], "sourceIdentifier": "cve@mitre.org", "vendorComments": [{"comment": "Red Hat does not consider this to be a security issue. Regression introduced break glob() functionality, but does not bypass security restrictions.\n\nFurthermore, "open_basedir" bypass issues are not treated as security sensitive as described at https://bugzilla.redhat.com/show_bug.cgi?id=169857#c1 and\nhttp://www.php.net/security-note.php", "lastModified": "2008-01-10T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}, {"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}