CVE-2014-4721 Information disclosure in n/a
Attackers can read sensitive process memory, such as private SSL keys, via type confusion in PHP's phpinfo function when specific server configurations are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-4721?
CVE-2014-4721 is a low-severity vulnerability in Debian Debian Linux, published on 6 Jul 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.
Weakness: CWE-200
Which versions are affected by CVE-2014-4721?
It affects 2 products.
Products include Debian Debian Linux, Php Php.
How do I fix CVE-2014-4721?
Upgrade to a fixed version.
Is CVE-2014-4721 being exploited?
There is no known exploitation of CVE-2014-4721 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-crxc-8h2p-6c8g, UBUNTU-CVE-2014-4721.