2013-03-06 14:10:27 2014-01-28 05:51:42

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

Vector

NETWORK

Complexity

LOW

Authentication

NONE

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL
Janetter 2.5.0.0 Jansson 2.1 Jansson 2.2 Jane Janetter 2.0.2.0 Jan Kara Linux DiskQuota (aka quota) 3.01-pre8 Jane Janetter 2.1.1.0 Jane Janetter 2.1.0.0 Jane Janetter 2.0.3.0 jasig phpCAS 0.4.1 Janetter 2.0.1.0 Janetter 2.0.2.0 Janetter 2.0.3.0 Janetter 2.1.0.0 Jan Kara Linux DiskQuota (aka quota) 3.02 Janetter 1.5.0.0 Janetter 2.0.0.1 Janetter 2.5.1.0 Janetter 3.0.0.0 JanRain PHP OpenID library (aka php-openid) 2.2.2 Janrain Engine RPX module for Drupal 6.x-1.0 beta 1 Jane Janetter 1.7.1.0 Tracking Requirements & Use Cases (TRUC) 0.12.0 janrain ruby-openid 2.2.1 for Ruby Jan Kara Linux DiskQuota (aka quota) 3.03 janrain ruby-openid 2.2.3 for Ruby Jan Kara Linux DiskQuota (aka quota) 3.14 Janetter 1.7.2.0 janrain ruby-openid 2.2.2 for Ruby Jan Kara Linux DiskQuota (aka quota) 3.13 Janetter 1.7.1.0 Jansson 2.0 Jan Kara Linux DiskQuota (aka quota) 3.16 Janetter 1.7.0.0 janrain ruby-openid 2.3.0 for Ruby Jan Kara Linux DiskQuota (aka quota) 3.15 Tracking Requirements & Use Cases (TRUC) 0.11.0 Jansson 2.0.1 Tracking Requirements & Use Cases (TRUC) 0.10.0 Jane Janetter 1.6.1.0 Jane Janetter 1.6.2.0 Jane Janetter 1.6.3.0 Jan Kara Linux DiskQuota (aka quota) 3.01-pre9 Jane Janetter 1.7.0.0 Jane Janetter 1.4.0.0 Janrain Engine RPX module for Drupal 6.x-1.0 dev Jane Janetter 1.5.0.0 Jane Janetter 1.6.0.0 Jansson 2.2.1 Jansson 2.3.1 Jansson 2.3 jasig phpCAS 0.4.10 jasig phpCAS 0.4.12 Janrain Engine RPX module for Drupal 7.x-2.1 jasig phpCAS 0.4.11 Janrain Engine RPX module for Drupal 7.x-2.0 jasig phpCAS 0.4.14 jasig phpCAS 0.4.13 jasig phpCAS 0.4.16 jasig phpCAS 0.4.15 Janetter 1.6.3.0 Janetter 1.6.2.0 Janetter 1.6.1.0 Janetter 1.6.0.0 Jan Kara Linux DiskQuota (aka quota) 3.12 Janetter 1.3.0.0 Janetter 1.2.1.0 Janetter 1.4.0.0 Janetter 1.0.0.0 Janetter 1.2.0.0 Janetter 1.1.0.0 Janetter 2.4.0.0 Jan Kara Linux DiskQuota (aka quota) 3.01-pre7 Jane Janetter 2.0.1.0 Jane Janetter 2.0.0.1 Jane Janetter 1.7.2.0 Jane Janetter 2.5.1.0 Jane Janetter 2.4.0.0 Jane Janetter 2.5.0.0 Jane Janetter 2.1.1.1 Janetter 3.4.0.0 Jane Janetter 2.1.1.2 Janetter 3.2.1.1 Janetter 3.3.0.0 Janetter 3.2.0.0 Tracking Requirements & Use Cases (TRUC) 0.9.0 Janetter 3.2.1.0 Janetter 3.1.0.1 Janetter 3.1.1.0 Janetter 2.1.1.0 Janetter 3.1.0.0 Janetter 2.1.1.2 Janetter 2.1.1.1 Janetter 2.3.0.0 Janetter 2.2.0.0 janrain ruby-openid 2.2.0 for Ruby Janrain Engine RPX module for Drupal 6.x-1.2 Janrain Engine RPX module for Drupal 6.x-1.2 release canidate 2 Janrain Engine RPX module for Drupal 7.x-1.x-dev Janrain Engine RPX module for Drupal 6.x-1.4 Janrain Engine RPX module for Drupal 6.x-1.0 release canidate 1 Janrain Engine RPX module for Drupal 6.x-1.3 Janrain Engine RPX module for Drupal 6.x-1.0 release canidate 2 Janrain Engine RPX module for Drupal 6.x-1.1 release canidate 2 Janrain Engine RPX module for Drupal 6.x-2.1 beta2 Janrain Engine RPX module for Drupal 6.x-2.1 beta3 Janrain Engine RPX module for Drupal 6.x-2.1 Janrain Engine RPX module for Drupal 6.x-2.1 beta1 Janrain Engine RPX module for Drupal 7.x-1.0 release candidate 1 Janrain Engine RPX module for Drupal 7.x-1.0 release candidate 2 Janrain Engine RPX module for Drupal 6.x-2.2 Janrain Engine RPX module for Drupal 7.x-1.0 beta1 Janrain Engine RPX module for Drupal 6.x-2.1 dev Janrain Engine RPX module for Drupal 6.x-2.1 release candidate 1 Jan Kara Linux DiskQuota (aka quota) 3.11 Jane Janetter 3.2.1.0 Jane Janetter 3.3.0.0 Jane Janetter 3.2.1.1 Jane Janetter 1.3.0.0 Jane Janetter 1.2.0.0 Jane Janetter 3.4.0.0 Jane Janetter 1.0.0.0 Jan Kara Linux DiskQuota (aka quota) 3.04 Jan Kara Linux DiskQuota (aka quota) 3.05 Jan Kara Linux DiskQuota (aka quota) 3.06 Jane Janetter 1.2.1.0 Jan Kara Linux DiskQuota (aka quota) 3.07 Jan Kara Linux DiskQuota (aka quota) 3.08 Jane Janetter 1.1.0.0 Jan Kara Linux DiskQuota (aka quota) 3.09 Jan Kara Linux DiskQuota (aka quota) 3.10 Jane Janetter 3.0.0.0 Jane Janetter 3.1.0.1 Jane Janetter 3.1.0.0 Jane Janetter 3.2.0.0 Jane Janetter 2.3.0.0 Jane Janetter 3.1.1.0 Jane Janetter 2.2.0.0