ID CVE-2004-1020
Summary The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
Vulnerable Configurations
  • PHP PHP 4.3.6
  • PHP PHP 4.3.7
  • PHP PHP 4.3.8
  • PHP PHP 4.3.9
  • PHP PHP 5.0.0
  • PHP PHP 5.0.1
  • PHP PHP 5.0.2
  • cpe:2.3:a:php:php:5.0:rc1
  • cpe:2.3:a:php:php:5.0:rc2
  • cpe:2.3:a:php:php:5.0:rc3
Base: 5.0 (as of 01-01-2004 - 00:00)
exploit-db via4
description PHP 4/5 addslashes() NULL Byte Bypass. CVE-2004-1020. Remote exploit for php platform
id EDB-ID:24985
last seen 2016-02-03
modified 2004-12-16
published 2004-12-16
reporter Daniel Fabian
title PHP 4/5 addslashes NULL Byte Bypass
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200412-14.NASL
    description The remote host is affected by the vulnerability described in GLSA-200412-14 (PHP: Multiple vulnerabilities) Stefan Esser and Marcus Boerger reported several different issues in the unserialize() function, including serious exploitable bugs in the way it handles negative references (CAN-2004-1019). Stefan Esser also discovered that the pack() and unpack() functions are subject to integer overflows that can lead to a heap buffer overflow and a heap information leak. Finally, he found that the way multithreaded PHP handles safe_mode_exec_dir restrictions can be bypassed, and that various path truncation issues also allow to bypass path and safe_mode restrictions. Ilia Alshanetsky found a stack overflow issue in the exif_read_data() function (CAN-2004-1065). Finally, Daniel Fabian found that addslashes and magic_quotes_gpc do not properly escape null characters and that magic_quotes_gpc contains a bug that could lead to one level directory traversal. Impact : These issues could be exploited by a remote attacker to retrieve web server heap information, bypass safe_mode or path restrictions and potentially execute arbitrary code with the rights of the web server running a PHP application. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 16001
    published 2004-12-19
    reporter Tenable
    title GLSA-200412-14 : PHP: Multiple vulnerabilities
  • NASL family CGI abuses
    description According to its banner, the version of PHP installed on the remote host is prior to 4.3.10 / 5.0.3. It is, therefore, affected by multiple security issues that could, under certain circumstances, allow an attacker to execute arbitrary code on the remote host, provided that the attacker can pass arbitrary data to some functions, or to bypass safe_mode.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 15973
    published 2004-12-15
    reporter Tenable
    title PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities
  • NASL family MacOS X Local Security Checks
    description he remote host is missing Security Update 2005-001. This security update contains a number of fixes for the following programs : - at commands - ColorSync - libxml2 - Mail - PHP - Safari - SquirrelMail These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 16251
    published 2005-01-26
    reporter Tenable
    title Mac OS X Multiple Vulnerabilities (Security Update 2005-001)
  • NASL family Mandriva Local Security Checks
    description A number of vulnerabilities in PHP versions prior to 4.3.10 were discovered by Stefan Esser. Some of these vulnerabilities were not deemed to be severe enough to warrant CVE names, however the packages provided, with the exception of the Corporate Server 2.1 packages, include fixes for all of the vulnerabilities, thanks to the efforts of the OpenPKG team who extracted and backported the fixes. The vulnerabilities fixed in all provided packages include a fix for a possible information disclosure, double free, and negative reference index array underflow in deserialization code (CVE-2004-1019). As well, the exif_read_data() function suffers from an overflow on a long sectionname; this vulnerability was discovered by Ilia Alshanetsky (CVE-2004-1065). The other fixes that appear in Mandrakelinux 9.2 and newer packages include a fix for out of bounds memory write access in shmop_write() and integer overflow/underflows in the pack() and unpack() functions. The addslashes() function did not properly escape '�' correctly. A directory bypass issue existed in safe_mode execution. There is an issue of arbitrary file access through path truncation. Finally, the 'magic_quotes_gpc' functionality could lead to one level directory traversal with file uploads.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 15998
    published 2004-12-19
    reporter Tenable
    title Mandrake Linux Security Advisory : php (MDKSA-2004:151)
refmap via4
bid 11981
bugtraq 20041216 PHP Input Validation Vulnerabilities
conectiva CLA-2005:915
gentoo GLSA-200412-14
hp HPSBMA01212
mandrake MDKSA-2004:151
xf php-addslashes-view-files(18516)
statements via4
contributor Joshua Bressers
lastmodified 2007-08-26
organization Red Hat
statement Red Hat does not consider this issue to be a security vulnerability since no trust boundary is crossed. There are no known uses of this function which could allow a remote attacker to execute arbitrary code.
Last major update 10-09-2008 - 15:28
Published 10-01-2005 - 00:00
Last modified 10-07-2017 - 21:30
Back to Top