PT-2007-2964 · Php · Php

Stefan Esser · Publicado 2007-03-21 · Atualizado 2018-10-30 · CVE-2007-1581

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions 5.0.0 through 5.3.2

Description The resource system in PHP allows context-dependent attackers to execute arbitrary code by interrupting the hash update file function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources.

Recommendations For PHP versions 5.0.0 through 5.3.2, consider disabling the hash update file function until a patch is available to prevent exploitation. Restrict access to the resource system to minimize the risk of arbitrary code execution.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-1581

Produtos afetados

Php

Referências · 9

• 🔥 http://php-security.org/MOPB/MOPB-28-2007.html · Exploit
• 🔥 https://exploit-db.com/exploits/3529 · Exploit
• 🔥 http://php-security.org/2010/05/01/mops-2010-001-php-hash_update_file-already-freed-resource-access-vulnerability/index.html · Exploit
• 🔥 http://securityfocus.com/bid/23062 · Exploit
• http://milw0rm.com/exploits/3529 · Nota
• http://secunia.com/advisories/24542 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-1581 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33248 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1581 · Nota