PT-2007-5924 · Php · Php

Laurent Gaffie · Publicado 2007-09-10 · Atualizado 2018-10-15 · CVE-2007-4784

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.2.4

Description: The issue allows context-dependent attackers to cause a denial of service, resulting in an application crash, by providing a long string in the locale parameter to the setlocale function. This might not be considered a vulnerability in most web server environments that support multiple threads, unless it can be demonstrated to allow code execution.

Recommendations: For PHP versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the length of the string passed to the locale parameter in the setlocale function to prevent denial of service attacks.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-4784

Produtos afetados

Php

Referências · 11

• http://securityfocus.com/archive/1/478627/100/0/threaded · Nota
• http://gentoo.org/security/en/glsa/glsa-200710-02.xml · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html · Aviso do Fabricante
• http://osvdb.org/38687 · Nota
• http://secunia.com/advisories/28658 · Nota
• http://secunia.com/advisories/27102 · Nota
• http://securityreason.com/securityalert/3114 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4784 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36458 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4784 · Nota de Segurança
• http://securityfocus.com/archive/1/archive/1/478627/100/0/threaded · Nota