CVE-2004-1019: Input Validation

Published Dec 22, 2004

Updated

The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.

Affected Software

65 affected components

PHP PHP=4.3.9

PHP PHP=3.0

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=4.2.0

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.1.0

Openpkg Openpkg=2.1

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=3.0.8

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

Openpkg Openpkg=current

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=4.0.1-patch1

PHP PHP=4.0

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=4.0.7-rc3

Openpkg Openpkg=2.2

PHP PHP=4.3.1

PHP PHP=3.0.18

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=3.0.12

PHP PHP=4.2

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

Trustix Secure Linux=2.0

Ubuntu Ubuntu Linux=4.1

Trustix Secure Linux=2.1

Trustix Secure Linux=2.2

Ubuntu Ubuntu Linux=4.1

Remediation

Patch Available

http://www.redhat.com/support/errata/RHSA-2004-687.html

Event History

Dec 22, 2004

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1019?

CVE-2004-1019 has a severity rating that can potentially lead to denial of service and execution of arbitrary code, indicating a serious security concern.

How do I fix CVE-2004-1019?

To fix CVE-2004-1019, upgrade to PHP version 4.3.10 or later, or to PHP 5.x version 5.0.3 or later.

What types of attacks can CVE-2004-1019 facilitate?

CVE-2004-1019 can facilitate remote denial of service attacks and arbitrary code execution via malicious unserialize input.

What versions of PHP are affected by CVE-2004-1019?

CVE-2004-1019 affects PHP versions before 4.3.10 and all 5.x versions up to and including 5.0.2.

How can I prevent exploitation of CVE-2004-1019?

To prevent exploitation of CVE-2004-1019, avoid using untrusted data with the unserialize function and ensure PHP is upgraded to an unaffected version.