PT-2007-2773 · Php · Ovrimos Extension For Php

Published 2007-03-09 · Updated 2018-10-30 · CVE-2007-1378

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ovrimos extension for PHP versions prior to 4.4.5

Description The issue is due to the ovrimos longreadlen function in the Ovrimos Extension not properly sanitizing user-supplied input, allowing context-dependent attackers to write to arbitrary memory locations via the result id and length arguments. This may allow an attacker to manipulate arbitrary portions of system memory and execute code, potentially gaining elevated privileges.

Recommendations For Ovrimos extension for PHP versions prior to 4.4.5, update to version 4.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the ovrimos longreadlen function until a patch is applied. Avoid using the result id and length arguments in the affected function until the issue is resolved.

Fix

Related Identifiers

CVE-2007-1378

Affected Products

Ovrimos Extension For Php

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-1378 · Security Note
• http://php-security.org/MOPB/MOPB-13-2007.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1378 · Note
• http://osvdb.org/32779 · Note
• http://securityfocus.com/bid/22833 · Note