FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-7068

This CVE name corresponds to:

Entered	Topic
2009-05-16	php -- ini database truncation inside dba_replace() function

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-7068 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-7068
Phase	Assigned(20090824)

Description

The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.

References

Source	Reference
SREASONRES	20081127 PHP 5.2.6 dba_replace() destroying file
BUGTRAQ	20081127 SecurityReason : PHP 5.2.6 dba_replace() destroying file
BUGTRAQ	20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file
BUGTRAQ	20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file
CONFIRM	http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313&r2=1.2027.2.547.2.1314&
OSVDB	52206
XF	php-dbareplace-file-corruption(47316)