PT-2007-2854 · Php · Php

Publicado 2007-03-14 · Atualizado 2011-05-24 · CVE-2007-1460

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 4.4.7 PHP versions 5.2.0 and 5.2.1

Description The issue concerns the zip:// URL wrapper provided by the PECL zip extension in PHP, which fails to implement safemode or open basedir checks. This allows remote attackers to read ZIP archives located outside of the intended directories.

Recommendations For PHP versions prior to 4.4.7, update to version 4.4.7 or later. For PHP versions 5.2.0 and 5.2.1, update to a version later than 5.2.1.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-1460

Produtos afetados

Php

Referências · 13

• http://vupen.com/english/advisories/2007/2732 · Aviso do Fabricante
• http://securityfocus.com/bid/25159 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1460 · Nota
• http://secunia.com/advisories/26235 · Aviso do Fabricante
• http://us2.php.net/releases/5_2_2.php · Nota
• http://securityfocus.com/bid/22954 · Nota
• http://php-security.org/MOPB/MOPB-20-2007.html · Nota
• http://secunia.com/advisories/25056 · Aviso do Fabricante
• http://us2.php.net/releases/4_4_7.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1460 · Nota de Segurança
• http://docs.info.apple.com/article.html?artnum=306172 · Nota
• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2007_32_php.html · Aviso do Fabricante