CVE-2009-0754
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 0.9%
from disclosure to weapon0 days
Published on NVDMar 3
1st PoCJan 30
exploitation probability
0.9%top 42% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
Affected products
n/a · n/apublic PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/32769⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://bugs.php.net/bug.php?id=27421http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlhttp://secunia.com/advisories/34642http://secunia.com/advisories/34830http://secunia.com/advisories/35003http://secunia.com/advisories/35007http://secunia.com/advisories/35306https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11035https://usn.ubuntu.com/761-1/https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.htmlhttp://www.debian.org/security/2009/dsa-1789