PT-2007-2773 · Php · Ovrimos Extension For Php

Publicado 2007-03-09 · Atualizado 2018-10-30 · CVE-2007-1378

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ovrimos extension for PHP versions prior to 4.4.5

Description The issue is due to the ovrimos longreadlen function in the Ovrimos Extension not properly sanitizing user-supplied input, allowing context-dependent attackers to write to arbitrary memory locations via the result id and length arguments. This may allow an attacker to manipulate arbitrary portions of system memory and execute code, potentially gaining elevated privileges.

Recommendations For Ovrimos extension for PHP versions prior to 4.4.5, update to version 4.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the ovrimos longreadlen function until a patch is applied. Avoid using the result id and length arguments in the affected function until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-1378

Produtos afetados

Ovrimos Extension For Php

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-1378 · Nota de Segurança
• http://php-security.org/MOPB/MOPB-13-2007.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1378 · Nota
• http://osvdb.org/32779 · Nota
• http://securityfocus.com/bid/22833 · Nota