PT-2007-3833 · Php+1 · Php+1

Published 2007-05-08 · Updated 2018-10-30 · CVE-2007-2509

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 4.4.7 PHP versions 5.x prior to 5.2.2

Description The issue is related to a CRLF injection vulnerability in the ftp putcmd function. This allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.

Recommendations For PHP versions prior to 4.4.7, update to version 4.4.7 or later. For PHP versions 5.x prior to 5.2.2, update to version 5.2.2 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-2509

DSA-1295-1

DSA-1296-1

DTSA-39-1

DTSA-40-1

RHSA-2007:0348

RHSA-2007:0349

RHSA-2007:0355

RHSA-2007:0888

RHSA-2007:0889

RHSA-2007_0348

RHSA-2007_0349

Affected Products

Php

Red Hat

References · 42

• http://debian.org/security/2007/dsa-1296 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200705-19.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0355.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2007-0889.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0349.html · Vendor Advisory
• http://secunia.com/advisories/25318 · Vendor Advisory
• http://secunia.com/advisories/25191 · Vendor Advisory
• http://debian.org/security/2007/dsa-1295 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0888.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2509 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:102 · Vendor Advisory
• http://secunia.com/advisories/25187 · Vendor Advisory
• http://trustix.org/errata/2007/0017 · Vendor Advisory
• http://ubuntu.com/usn/usn-462-1 · Vendor Advisory