CVE-2003-1307

State: Published
Severity: Not scored
Published: Oct 23, 2006
Updated: Aug 8, 2024
Reserved: Oct 23, 2006

Description

The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

20061019 PHP "exec", "system", "popen" problemmailing-list
20061020 Re: PHP "exec", "system", "popen" (+small POC)mailing-list
http://bugs.php.net/38915
20031226 Hijacking Apache https by mod_phpmailing-list
http://hackerdom.ru/~dimmo/phpexpl.c
9302vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.