1. CVE-Search
  2. CVE-2010-0397
ID CVE-2010-0397
Summary The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly have unspecified other impact via a crafted argument. Per: http://cwe.mitre.org/data/slices/2000.html Improper Check for Unusual or Exceptional Conditions CWE-754
References
Vulnerable Configurations
  • cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 10-12-2010 - 06:37)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
rhsa
id RHSA-2010:0919
rpms
  • php-0:4.3.9-3.31
  • php-0:5.1.6-27.el5_5.3
  • php-bcmath-0:5.1.6-27.el5_5.3
  • php-cli-0:5.1.6-27.el5_5.3
  • php-common-0:5.1.6-27.el5_5.3
  • php-dba-0:5.1.6-27.el5_5.3
  • php-debuginfo-0:4.3.9-3.31
  • php-debuginfo-0:5.1.6-27.el5_5.3
  • php-devel-0:4.3.9-3.31
  • php-devel-0:5.1.6-27.el5_5.3
  • php-domxml-0:4.3.9-3.31
  • php-gd-0:4.3.9-3.31
  • php-gd-0:5.1.6-27.el5_5.3
  • php-imap-0:4.3.9-3.31
  • php-imap-0:5.1.6-27.el5_5.3
  • php-ldap-0:4.3.9-3.31
  • php-ldap-0:5.1.6-27.el5_5.3
  • php-mbstring-0:4.3.9-3.31
  • php-mbstring-0:5.1.6-27.el5_5.3
  • php-mysql-0:4.3.9-3.31
  • php-mysql-0:5.1.6-27.el5_5.3
  • php-ncurses-0:4.3.9-3.31
  • php-ncurses-0:5.1.6-27.el5_5.3
  • php-odbc-0:4.3.9-3.31
  • php-odbc-0:5.1.6-27.el5_5.3
  • php-pdo-0:5.1.6-27.el5_5.3
  • php-pear-0:4.3.9-3.31
  • php-pgsql-0:4.3.9-3.31
  • php-pgsql-0:5.1.6-27.el5_5.3
  • php-snmp-0:4.3.9-3.31
  • php-snmp-0:5.1.6-27.el5_5.3
  • php-soap-0:5.1.6-27.el5_5.3
  • php-xml-0:5.1.6-27.el5_5.3
  • php-xmlrpc-0:4.3.9-3.31
  • php-xmlrpc-0:5.1.6-27.el5_5.3
refmap via4
apple
  • APPLE-SA-2010-08-24-1
  • APPLE-SA-2010-11-10-1
bid 38708
confirm
mandriva MDVSA-2010:068
mlist [oss-security] 20100312 CVE-2010-0397: NULL pointer dereference in PHP's xmlrpc extension
secunia 42410
suse
  • SUSE-SR:2010:012
  • SUSE-SR:2010:013
  • SUSE-SR:2010:017
vupen
  • ADV-2010-0724
  • ADV-2010-3081
statements via4
contributor Vincent Danen
lastmodified 2010-03-22
organization Red Hat
statement Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0397 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.
Last major update 10-12-2010 - 06:37
Published 16-03-2010 - 19:30
Last modified 10-12-2010 - 06:37
Back to Top