PT-2005-4213 · Php+1 · Php+1

Stefan Esser · Published 2005-11-01 · Updated 2016-10-18 · CVE-2005-3417

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpBB versions 2.0.17 and earlier

Description The issue allows remote attackers to modify global variables and bypass security mechanisms. This occurs because PHP does not define the associated HTTP * variables when the register long arrays directive is disabled.

Recommendations For phpBB versions 2.0.17 and earlier, consider enabling the register long arrays directive as a temporary workaround to prevent the modification of global variables. However, note that this directive is deprecated and its use is generally discouraged. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-3417

DSA-925-1

Affected Products

Php

Phpbb

References · 11

• http://securityfocus.com/bid/15243 · Patch
• http://securitytracker.com/id?1015121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3417 · Security Note
• http://debian.org/security/2005/dsa-925 · Vendor Advisory
• http://hardened-php.net/advisory_172005.75.html · Vendor Advisory
• http://secunia.com/advisories/18098 · Note
• http://marc.info/?l=bugtraq&m=113081113317600&w=2 · Note
• http://securityreason.com/securityalert/130 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3417 · Note
• http://secunia.com/advisories/17366 · Note
• http://osvdb.org/20414 · Note