PT-2007-4485 · Suhosin+2 · Suhosin+2

Darkfig · Published 2007-06-13 · Updated 2018-10-16 · CVE-2007-3205

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PHP (affected versions not specified) Hardened-PHP (affected versions not specified) Suhosin (affected versions not specified)

Description: The issue concerns the parse str function, which may allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed when called without a second parameter. This could potentially be regarded as a design limitation of the function or a bug in the affected software.

Recommendations: For PHP, consider adding a second parameter to the parse str function to prevent variable overwriting. For Hardened-PHP, consider modifying the parse str function to handle cases where it is called without a second parameter. For Suhosin, consider restricting the use of the parse str function until a more robust solution is implemented. As a temporary workaround, consider disabling the use of the parse str function without a second parameter until a patch is available.

Fix

Related Identifiers

CVE-2007-3205

Affected Products

Hardened-Php

Php

Suhosin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-3205 · Security Note
• http://osvdb.org/39834 · Note
• http://securityfocus.com/archive/1/471275/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34836 · Note
• http://acid-root.new.fr/advisories/14070612.txt · Note
• http://securityreason.com/securityalert/2800 · Note
• http://securityfocus.com/archive/1/471178/100/0/threaded · Note
• http://securityfocus.com/archive/1/471204/100/0/threaded · Note