Vulnerability-Lookup

FKIE_CVE-2008-7068

Vulnerability from fkie_nvd - Published: 2009-08-25 10:30 - Updated: 2026-04-23 00:35

Severity

Summary

The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.

References

URL	Tags
cve@mitre.org	http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313&r2=1.2027.2.547.2.1314&	Vendor Advisory
cve@mitre.org	http://securityreason.com/achievement_securityalert/58	Exploit
cve@mitre.org	http://www.osvdb.org/52206
cve@mitre.org	http://www.securityfocus.com/archive/1/498746/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/archive/1/498981/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/archive/1/498982/100/0/threaded
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/47316
af854a3a-2127-422b-91ae-364da2661108	http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313&r2=1.2027.2.547.2.1314&	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://securityreason.com/achievement_securityalert/58	Exploit
af854a3a-2127-422b-91ae-364da2661108	http://www.osvdb.org/52206
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/498746/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/498981/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/498982/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/47316

Impacted products

Vendor	Product	Version
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0.0
php	php	4.0.1
php	php	4.0.1
php	php	4.0.1
php	php	4.0.2
php	php	4.0.3
php	php	4.0.3
php	php	4.0.4
php	php	4.0.4
php	php	4.0.5
php	php	4.0.6
php	php	4.0.7
php	php	4.0.7
php	php	4.0.7
php	php	4.0.7
php	php	4.0.7
php	php	4.1.0
php	php	4.1.1
php	php	4.1.2
php	php	4.2
php	php	4.2.0
php	php	4.2.1
php	php	4.2.2
php	php	4.2.3
php	php	4.3.0
php	php	4.3.1
php	php	4.3.2
php	php	4.3.3
php	php	4.3.4
php	php	4.3.5
php	php	4.3.6
php	php	4.3.7
php	php	4.3.8
php	php	4.3.9
php	php	4.3.10
php	php	4.3.11
php	php	4.4.0
php	php	4.4.1
php	php	4.4.2
php	php	4.4.3
php	php	4.4.4
php	php	4.4.5
php	php	4.4.6
php	php	4.4.7
php	php	4.4.8
php	php	4.4.9
php	php	5.2.6

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDBEC461-D553-41B7-8D85-20B6A933C21C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*",
              "matchCriteriaId": "AEEF2298-98E8-409F-9205-84817CEF947B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "6AFC00BA-D64D-4407-AC69-FDD9FF013943",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "D80F2A8B-B57F-4970-867A-55E8187C1502",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "EF4E0EFE-4FF6-4E8F-8EC5-68B059FC0C42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "49965B80-DC27-4864-BDF0-CBBFF16BFD80",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "8212495A-0F2A-4787-93F2-F6618F9A777B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C6F0F8FC-C57A-4AEA-A59F-41140347318A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BF57C14-86B6-419A-BAFF-93D01CB1E081",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "78BAA18C-E5A0-4210-B64B-709BBFF31EEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "419867C6-37BE-43B4-BFE0-6325FEE3807D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:*",
              "matchCriteriaId": "37896E87-95C2-4039-8362-BC03B1C56706",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "13A159B4-B847-47DE-B7F8-89384E6C551B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "57B59616-A309-40B4-94B1-50A7BC00E35C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "8667FBC6-04B6-40E5-93B3-6C22BEED4B26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F39A1B1-416E-4436-8007-733B66904A14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.4:patch1:*:*:*:*:*:*",
              "matchCriteriaId": "9B8B3138-3DCC-4682-B9A8-920E1110700D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD5FC218-3DDB-4981-81C9-6C69F8DA6F4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC2E5F96-66D2-4F99-A74D-6A2305EE218E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D724D09-0D45-4701-93C9-348301217C8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "FC6A6F47-5C7C-4F82-B23B-9C959C69B27F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "AE1A4DA6-6181-43A8-B0D8-5A016C3E75FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "6E36203C-1392-49BB-AE7E-49626963D673",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.0.7:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "FE287FF5-53C6-43E6-9FEB-28CD6185EB2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6713614A-B14E-4A85-BF89-ED780068FC68",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD95F8EB-B428-4B3C-9254-A5DECE03A989",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "069EB7EE-06B9-454F-9007-8DE5DCA33C53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.2:*:dev:*:*:*:*:*",
              "matchCriteriaId": "BBA861A2-F0CD-4DBB-B43A-4970EB114DA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "18BF5BE6-09EA-45AD-93BF-2BEF1742534E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC1460DF-1687-4314-BF1A-01290B20302D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "470380B0-3982-48FC-871B-C8B43C81900D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FAA7712-10F0-4BB6-BAFB-D0806AFD9DE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "63190D9B-7958-4B93-87C6-E7D5A572F6DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AB2E2E8-81D6-4973-AC0F-AA644EE99DD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AAF4586-74FF-47C6-864B-656FDF3F33D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B14EF0C7-61F2-47A4-B7F8-43FF03C62DCA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5245F990-B4A7-4ED8-909D-B8137CE79FAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "5652D5B0-68E4-4239-B9B7-599AFCF4C53E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "57B71BB7-5239-4860-9100-8CABC3992D8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "72BD447A-4EED-482C-8F61-48FAD4FCF8BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3F9DF9D-15E5-4387-ABE3-A7583331A928",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "11579E5C-D7CF-46EE-B015-5F4185C174E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "C69CDE21-2FD4-4529-8F02-8709CF5E3D7E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "221B9AC4-C63C-4386-B3BD-E4BC102C6124",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "78B7BA75-2A32-4A8E-ADF8-BCB4FC48CB5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2BEA491B-77FD-4760-8F6F-3EBC6BD810D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB25CFBB-347C-479E-8853-F49DD6CBD7D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D2937B3-D034-400E-84F5-33833CE3764D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "71AEE8B4-FCF8-483B-8D4C-2E80A02E925E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C2AF1D9-33B6-4B2C-9269-426B6B720164",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "84B70263-37AA-4539-A286-12038A3792C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E46E4B4-808C-4B47-81D9-EC2B02A5E57B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FF30D7F-353B-4496-9A89-4EF2BB279E0A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:4.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD97DF34-35AB-4979-96E2-B23DC8556A79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "A782CA26-9C38-40A8-92AE-D47B14D2FCE3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte.  NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n dba_replace en PHP v5.2.6 y 4.x permite a atacantes dependientes de contexto producir una denegaci\u00f3n de servicio (corte de fichero) a trav\u00e9s de una clave con un byte NULL. NOTA: Esto solo se produce en unas circunstancias muy concretas en la cual el atacante puede modificar o a\u00f1adir las entradas de la base de datos pero no tiene permisos para cortar el fichero."
    }
  ],
  "id": "CVE-2008-7068",
  "lastModified": "2026-04-23T00:35:47.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.4,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-08-25T10:30:00.377",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313\u0026r2=1.2027.2.547.2.1314\u0026"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://securityreason.com/achievement_securityalert/58"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/52206"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/498746/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/498981/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/498982/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47316"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313\u0026r2=1.2027.2.547.2.1314\u0026"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://securityreason.com/achievement_securityalert/58"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/52206"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/498746/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/498981/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/498982/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47316"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "This is not a security issue. A user with read and write access to a file can reasonably be expected to manipulate the contents of the file, including truncating it. Instead of using dba_replace(), a user could simply fopen() the file in write mode, which provides the same end-result.",
      "lastModified": "2009-08-27T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2008-7068 (GCVE-0-2008-7068)

Vulnerability from cvelistv5 – Published: 2009-08-25 10:00 – Updated: 2024-08-07 11:56

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre

References

7 references

URL	Tags
http://www.securityfocus.com/archive/1/498982/100…	mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.osvdb.org/52206	vdb-entryx_refsource_OSVDB
http://securityreason.com/achievement_securityalert/58	third-party-advisoryx_refsource_SREASONRES
http://www.securityfocus.com/archive/1/498746/100…	mailing-listx_refsource_BUGTRAQ
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2…	x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/498981/100…	mailing-listx_refsource_BUGTRAQ

Date Public

2008-11-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:56:14.170Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498982/100/0/threaded"
          },
          {
            "name": "php-dbareplace-file-corruption(47316)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47316"
          },
          {
            "name": "52206",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/52206"
          },
          {
            "name": "20081127 PHP 5.2.6 dba_replace() destroying file",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASONRES",
              "x_transferred"
            ],
            "url": "http://securityreason.com/achievement_securityalert/58"
          },
          {
            "name": "20081127 SecurityReason : PHP 5.2.6 dba_replace() destroying file",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498746/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313\u0026r2=1.2027.2.547.2.1314\u0026"
          },
          {
            "name": "20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498981/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-11-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte.  NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498982/100/0/threaded"
        },
        {
          "name": "php-dbareplace-file-corruption(47316)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47316"
        },
        {
          "name": "52206",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/52206"
        },
        {
          "name": "20081127 PHP 5.2.6 dba_replace() destroying file",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASONRES"
          ],
          "url": "http://securityreason.com/achievement_securityalert/58"
        },
        {
          "name": "20081127 SecurityReason : PHP 5.2.6 dba_replace() destroying file",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498746/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313\u0026r2=1.2027.2.547.2.1314\u0026"
        },
        {
          "name": "20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498981/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-7068",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte.  NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498982/100/0/threaded"
            },
            {
              "name": "php-dbareplace-file-corruption(47316)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47316"
            },
            {
              "name": "52206",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/52206"
            },
            {
              "name": "20081127 PHP 5.2.6 dba_replace() destroying file",
              "refsource": "SREASONRES",
              "url": "http://securityreason.com/achievement_securityalert/58"
            },
            {
              "name": "20081127 SecurityReason : PHP 5.2.6 dba_replace() destroying file",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498746/100/0/threaded"
            },
            {
              "name": "http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313\u0026r2=1.2027.2.547.2.1314\u0026",
              "refsource": "CONFIRM",
              "url": "http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313\u0026r2=1.2027.2.547.2.1314\u0026"
            },
            {
              "name": "20081206 Re: SecurityReason : PHP 5.2.6 dba_replace() destroying file",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498981/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-7068",
    "datePublished": "2009-08-25T10:00:00.000Z",
    "dateReserved": "2009-08-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T11:56:14.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2008-7068

CVE-2008-7068 (GCVE-0-2008-7068)

Tags

Sightings

Nomenclature