NVD Vulnerability Detail

CVE-2010-2094

Summary	Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.
Publication Date	May 28, 2010, 7:30 a.m.
Registration Date	Jan. 29, 2021, 11:01 a.m.
Last Update	Jan. 26, 2011, 3:48 p.m.

Affected software configurations

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html	SUSE
2	http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html	SUSE
3	http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html	MISC	Exploit
4	http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.html	MISC	Exploit
5	http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.html	MISC	Exploit
6	http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.html	MISC	Exploit
7	http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html	MISC	Exploit
8	http://www.mandriva.com/security/advisories?name=MDVSA-2011:004	MANDRIVA
9	http://www.vupen.com/english/advisories/2011/0068	VUPEN

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-134	書式文字列の問題	https://cwe.mitre.org/data/definitions/134.html

JVN Vulnerability Information

PHP の phar 拡張における重要な情報を取得される脆弱性

Title	PHP の phar 拡張における重要な情報を取得される脆弱性
Summary	PHP の phar 拡張には、phar_stream_flush、phar_wrapper_unlink、phar_parse_url、ext/phar /stream.c 内の phar_wrapper_open_url 関数および ext/phar/dirstream.c 内の phar_wrapper_open_dir 関数を適切に処理しないため、重要な情報を取得される、または任意のコードを実行される脆弱性が存在します。
Possible impacts	攻撃者により、php_stream_wrapper_log_error 関数のエラーを誘発する、巧妙に細工された phar:// URI を介して重要な情報を取得される、または任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 14, 2010, midnight
Registration Date	Aug. 18, 2010, 6:26 p.m.
Last Update	Aug. 18, 2010, 6:26 p.m.

Affected System

The PHP Group

PHP 5.3.2 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-2094	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2094
National Vulnerability Database (NVD)
2	CVE-2010-2094	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2094

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-134	https://jvndb.jvn.jp/ja/cwe/CWE-134.html

ベンダー情報

No	Name	URL
Month of PHP Security
1	MOPS-2010-024	http://www.php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html
2	MOPS-2010-025	http://www.php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.html
3	MOPS-2010-026	http://www.php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.html
4	MOPS-2010-027	http://www.php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.html
5	MOPS-2010-028	http://www.php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html

その他

No	Name	URL
Secunia Advisory
1	SA39573	http://secunia.com/advisories/39573
SecurityFocus
2	40173	http://www.securityfocus.com/bid/40173

Change Log

No	Changed Details	Date of change
0	[2010年08月18日] 掲載	Feb. 17, 2018, 10:37 a.m.