PT-2007-2776 · Php · Php

Publicado 2007-03-10 · Atualizado 2008-09-05 · CVE-2007-1381

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP 5 versions 1.119.2.10.2.12 through 1.119.2.10.2.13

Description The issue arises from the wddx deserialize function in wddx.c, which incorrectly uses strlcpy instead of strlcat and provides improper arguments. This allows attackers to execute arbitrary code via a WDDX packet containing a malformed overlap of a STRING element, triggering a buffer overflow.

Recommendations For PHP 5 versions 1.119.2.10.2.12 through 1.119.2.10.2.13, update to a version where the wddx deserialize function is fixed, specifically to a version after the fix on 20070304. As a temporary workaround, consider restricting the use of the wddx deserialize function to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-1381

Produtos afetados

Php

Referências · 7

• 🔥 https://exploit-db.com/exploits/3404 · Exploit
• 🔥 http://php-security.org/MOPB/MOPB-09-2007.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1381 · Nota de Segurança
• http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/wddx.c?r1=1.119.2.10.2.13&r2=1.119.2.10.2.14 · Nota
• http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/wddx.c?revision=1.119.2.10.2.14&view=markup · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1381 · Nota
• http://osvdb.org/32775 · Nota