PT-2007-2966 · Php+1 · Php+1

Published 2007-03-21 · Updated 2018-10-30 · CVE-2007-1583

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 4.0.0 through 4.4.6 PHP versions 5.0.0 through 5.2.1

Description The issue allows remote attackers to invoke available PHP scripts with register globals functionality that is not detectable by these scripts. This can be achieved by exploiting the mb parse str function, which sets the internal register globals flag and does not disable it in certain cases when a script terminates. An example of exploitation is forcing a memory limit violation.

Recommendations For PHP versions 4.0.0 through 4.4.6, update to a version that fixes this issue. For PHP versions 5.0.0 through 5.2.1, update to a version that fixes this issue. As a temporary workaround, consider disabling the mb parse str function until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2007-1583

DSA-1282-1

DSA-1283-1

DTSA-39-1

DTSA-40-1

RHSA-2007:0153

RHSA-2007:0155

RHSA-2007:0162

RHSA-2007_0153

RHSA-2007_0155

Affected Products

Php

Red Hat

References · 48

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/php/php_unserialize_zval_cookie.rb · Exploit
• 🔥 https://exploit-db.com/exploits/29752 · Exploit
• http://debian.org/security/2007/dsa-1283 · Vendor Advisory
• http://php-security.org/MOPB/MOPB-26-2007.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200705-19.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-455-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:089 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0162.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0153.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_32_php.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2007-0155.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:088 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1583 · Security Note
• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Vendor Advisory