PT-2007-2964 · Php · Php

Stefan Esser · Published 2007-03-21 · Updated 2018-10-30 · CVE-2007-1581

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions 5.0.0 through 5.3.2

Description The resource system in PHP allows context-dependent attackers to execute arbitrary code by interrupting the hash update file function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources.

Recommendations For PHP versions 5.0.0 through 5.3.2, consider disabling the hash update file function until a patch is available to prevent exploitation. Restrict access to the resource system to minimize the risk of arbitrary code execution.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-1581

Affected Products

Php

References · 9

• 🔥 http://php-security.org/MOPB/MOPB-28-2007.html · Exploit
• 🔥 https://exploit-db.com/exploits/3529 · Exploit
• 🔥 http://php-security.org/2010/05/01/mops-2010-001-php-hash_update_file-already-freed-resource-access-vulnerability/index.html · Exploit
• 🔥 http://securityfocus.com/bid/23062 · Exploit
• http://secunia.com/advisories/24542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1581 · Security Note
• http://milw0rm.com/exploits/3529 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33248 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1581 · Note