CVE-2009-3294 : The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x befor

The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.

Published 2009-09-22 10:30:01

Updated 2022-09-01 16:32:32

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Products affected by CVE-2009-3294

PHP » PHP
Versions from including (>=) 5.3.0 and before (<) 5.3.1
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7
When used together with: Microsoft » Windows Server 2008
When used together with: Microsoft » Windows Xp
PHP » PHP
Versions from including (>=) 5.2.0 and before (<) 5.2.11
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7
When used together with: Microsoft » Windows Server 2008
When used together with: Microsoft » Windows Xp

Exploit prediction scoring system (EPSS) score for CVE-2009-3294

EPSS FAQ

1.53%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 85 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-3294

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2009-3294

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2009-3294

Red Hat 2009-09-24

Not vulnerable. This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 3, 4, or 5, and Red Hat Application Stack v2.

References for CVE-2009-3294

http://news.php.net/php.announce/79

php.announce: 5.3.1 Release announcement
Vendor Advisory

CVEs referencing this url
http://bugs.php.net/bug.php?id=44683

Exploit;Vendor Advisory
http://www.php.net/releases/5_3_1.php

PHP: PHP 5.3.1 Release Announcement
Vendor Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2009/11/20/2

oss-security - CVE request: php 5.3.1 update
Mailing List

CVEs referencing this url
http://svn.php.net/viewvc?view=revision&revision=287779

Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/20/1

Mailing List;Patch
http://www.php.net/ChangeLog-5.php#5.2.11

Vendor Advisory

CVEs referencing this url
http://www.php.net/releases/5_2_11.php

Patch;Vendor Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2009/11/20/3

oss-security - Re: CVE request: php 5.3.1 update
Mailing List

CVEs referencing this url
http://www.php.net/ChangeLog-5.php

PHP: PHP 5 ChangeLog
Vendor Advisory

CVEs referencing this url