PT-2005-4213 · Php+1 · Php+1

Stefan Esser · Publicado 2005-11-01 · Atualizado 2016-10-18 · CVE-2005-3417

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBB versions 2.0.17 and earlier

Description The issue allows remote attackers to modify global variables and bypass security mechanisms. This occurs because PHP does not define the associated HTTP * variables when the register long arrays directive is disabled.

Recommendations For phpBB versions 2.0.17 and earlier, consider enabling the register long arrays directive as a temporary workaround to prevent the modification of global variables. However, note that this directive is deprecated and its use is generally discouraged. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-3417

DSA-925-1

Produtos afetados

Php

Phpbb

Referências · 11

• http://securityfocus.com/bid/15243 · Correção
• http://secunia.com/advisories/18098 · Nota
• http://securitytracker.com/id?1015121 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=113081113317600&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3417 · Nota de Segurança
• http://debian.org/security/2005/dsa-925 · Aviso do Fabricante
• http://securityreason.com/securityalert/130 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3417 · Nota
• http://hardened-php.net/advisory_172005.75.html · Aviso do Fabricante
• http://secunia.com/advisories/17366 · Nota
• http://osvdb.org/20414 · Nota