PT-2007-2776 · Php · Php

Published 2007-03-10 · Updated 2008-09-05 · CVE-2007-1381

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP 5 versions 1.119.2.10.2.12 through 1.119.2.10.2.13

Description The issue arises from the wddx deserialize function in wddx.c, which incorrectly uses strlcpy instead of strlcat and provides improper arguments. This allows attackers to execute arbitrary code via a WDDX packet containing a malformed overlap of a STRING element, triggering a buffer overflow.

Recommendations For PHP 5 versions 1.119.2.10.2.12 through 1.119.2.10.2.13, update to a version where the wddx deserialize function is fixed, specifically to a version after the fix on 20070304. As a temporary workaround, consider restricting the use of the wddx deserialize function to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-1381

Affected Products

Php

References · 7

• 🔥 https://exploit-db.com/exploits/3404 · Exploit
• 🔥 http://php-security.org/MOPB/MOPB-09-2007.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1381 · Security Note
• http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/wddx.c?r1=1.119.2.10.2.13&r2=1.119.2.10.2.14 · Note
• http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/wddx.c?revision=1.119.2.10.2.14&view=markup · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1381 · Note
• http://osvdb.org/32775 · Note