CVE-2012-1172:CVE-2012-1172 is a vulnerability in PHP before version 5.4.0 that allows remote attackers to conduct denial of service attacks or directory traversal attacks during multi-file uploads.

splash
Back

Description Preview

The file-upload implementation in PHP before 5.4.0 does not properly handle invalid characters in name values, specifically open square bracket characters, which can be exploited by remote attackers to cause a denial of service or conduct directory traversal attacks during multi-file uploads. This vulnerability arises from a lack of proper filename restrictions in scripts, making it easier for attackers to manipulate $_FILES indexes.

Overview

This vulnerability in PHP before version 5.4.0 allows remote attackers to exploit the file-upload implementation, leading to denial of service or directory traversal attacks during multi-file uploads. The issue stems from the mishandling of invalid characters in name values, particularly open square brackets, which can be leveraged by attackers to disrupt the normal operation of the affected PHP application.

Remediation

To remediate this vulnerability, users are advised to update their PHP installation to version 5.4.0 or later, where the file-upload implementation has been improved to properly handle invalid characters in name values. Additionally, developers should ensure that their scripts enforce proper filename restrictions to mitigate the risk of exploitation through $_FILES indexes manipulation.

References

  1. HP Security Bulletin SSRT100856: http://marc.info/?l=bugtraq&m=134012830914727&w=2
  2. PHP Bug #54374: https://bugs.php.net/bug.php?id=54374
  3. Fedora Update FEDORA-2012-6869: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080070.html
  4. SUSE-SU-2012:0604 Advisory: http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html
  5. PHP Bug #49683: https://bugs.php.net/bug.php?id=49683
  6. Directory Traversal via PHP Multi-File Uploads: https://nealpoole.com/blog/2011/10/directory-traversal-via-php-multi-file-uploads/
  7. Apple Security Advisory APPLE-SA-2012-09-19-2: http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
  8. Debian Security Advisory DSA-2465: http://www.debian.org/security/2012/dsa-2465
  9. PHP ChangeLog for version 5.4.0: http://www.php.net/ChangeLog-5.php#5.4.0
  10. OSS Security Mailing List Discussion: http://openwall.com/lists/oss-security/2012/03/13/4

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing
    Manufacturing
  2. Health Care & Social Assistance
    Health Care & Social Assistance
  3. Public Administration
    Public Administration
  4. Transportation & Warehousing
    Transportation & Warehousing
  5. Educational Services
    Educational Services
  6. Finance and Insurance
    Finance and Insurance
  7. Other Services (except Public Administration)
    Other Services (except Public Administration)
  8. Utilities
    Utilities
  9. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  10. Management of Companies & Enterprises
    Management of Companies & Enterprises
  11. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  12. Retail Trade
    Retail Trade
  13. Construction
    Construction
  14. Information
    Information
  15. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  16. Wholesale Trade
    Wholesale Trade
  17. Accommodation & Food Services
    Accommodation & Food Services
  18. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  19. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  20. Mining
    Mining

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background