PT-2007-3833 · Php+1 · Php+1

Publicado 2007-05-08 · Atualizado 2018-10-30 · CVE-2007-2509

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 4.4.7 PHP versions 5.x prior to 5.2.2

Description The issue is related to a CRLF injection vulnerability in the ftp putcmd function. This allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.

Recommendations For PHP versions prior to 4.4.7, update to version 4.4.7 or later. For PHP versions 5.x prior to 5.2.2, update to version 5.2.2 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-2509

DSA-1295-1

DSA-1296-1

DTSA-39-1

DTSA-40-1

RHSA-2007:0348

RHSA-2007:0349

RHSA-2007:0355

RHSA-2007:0888

RHSA-2007:0889

RHSA-2007_0348

RHSA-2007_0349

Produtos afetados

Php

Red Hat

Referências · 42

• http://secunia.com/advisories/25365 · Nota
• http://secunia.com/advisories/25372 · Nota
• http://secunia.com/advisories/25445 · Nota
• http://debian.org/security/2007/dsa-1296 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200705-19.xml · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2007-0355.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2007:0348 · Nota
• http://rhn.redhat.com/errata/RHSA-2007-0889.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2007-2510 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2007-0349.html · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10839 · Nota
• http://securityreason.com/securityalert/2672 · Nota
• http://us2.php.net/releases/4_4_7.php · Nota
• http://secunia.com/advisories/25318 · Aviso do Fabricante