CVE-2008-7068 : The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers

The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.

Published 2009-08-25 10:30:00

Updated 2018-10-30 16:26:21

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validationDenial of service

Products affected by CVE-2008-7068

PHP » PHP » Version: 4.0
cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.1
cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.3
cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.4
cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.5
cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.6
cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.1.0
cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.1.1
cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.1.2
cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.1 Update Patch2
cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.1 Update Patch1
cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.7
cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.3 Update Patch1
cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.7 Update RC3
cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.2
cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.7 Update RC1
cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.7 Update RC2
cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.2.0
cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.2.1
cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.2.2
cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.2.3
cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.2 DEV Edition
cpe:2.3:a:php:php:4.2:*:dev:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0 Update Beta1
cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0 Update Beta3
cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0 Update Beta4
cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0 Update RC1
cpe:2.3:a:php:php:4.0:rc1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0 Update RC2
cpe:2.3:a:php:php:4.0:rc2:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.4 Update Patch1
cpe:2.3:a:php:php:4.0.4:patch1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0 Update Beta 4 Patch1
cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0 Update Beta2
cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.0
cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.1
cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.6
cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.2
cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.3
cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.5
cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.6
cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.7
cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.8
cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.4
cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.9
cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.10
cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.0
cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.0
cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.3.11
cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.1
cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.2
cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.3
cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.4
cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.9
cpe:2.3:a:php:php:4.4.9:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.7
cpe:2.3:a:php:php:4.4.7:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.8
cpe:2.3:a:php:php:4.4.8:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.2.6
cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.4.5
cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 4.0.7 Update RC4
cpe:2.3:a:php:php:4.0.7:rc4:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2008-7068

Top countries where our scanners detected CVE-2008-7068

Top open port discovered on systems with this issue 80

IPs affected by CVE-2008-7068 18,310

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2008-7068!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2008-7068

EPSS FAQ

1.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 86 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-7068

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.4	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2008-7068

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2008-7068

Red Hat 2009-08-27

This is not a security issue. A user with read and write access to a file can reasonably be expected to manipulate the contents of the file, including truncating it. Instead of using dba_replace(), a user could simply fopen() the file in write mode, which provides the same end-result.

References for CVE-2008-7068

Jump to