PT-2007-2878 · Php · Php

Stefan Esser · Published 2007-03-16 · Updated 2018-10-19 · CVE-2007-1484

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.1 PHP version 4.4.6 and earlier

Description The issue is related to the array user key compare function, which makes erroneous calls to zval dtor, leading to memory corruption. This allows local users to bypass safe mode and execute arbitrary code via a certain unset operation after array user key compare has been called.

Recommendations For PHP versions prior to 5.2.1, update to version 5.2.1 or later to resolve the issue. For PHP version 4.4.6 and earlier, consider upgrading to a newer version of PHP, as these versions are no longer supported. As a temporary workaround, consider restricting the use of the array user key compare function and the zval dtor function until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2007-1484

Affected Products

Php

References · 19

• 🔥 https://exploit-db.com/exploits/3499 · Exploit
• 🔥 http://php-security.org/MOPB/MOPB-24-2007.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1484 · Security Note
• http://security.gentoo.org/glsa/glsa-200705-19.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-455-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_32_php.html · Vendor Advisory
• http://vupen.com/english/advisories/2007/2732 · Note
• http://securityfocus.com/bid/25159 · Note
• http://secunia.com/advisories/26235 · Note
• http://docs.info.apple.com/article.html?artnum=306172 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1484 · Note
• http://secunia.com/advisories/24542 · Note
• http://securityfocus.com/bid/22990 · Note
• http://us2.php.net/releases/5_2_2.php · Note