CVE-2007-1583

Severity

68%

Complexity

86%

Confidentiality

106%

The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.

The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Overview

Type

PHP

First reported 17 years ago

2007-03-21 23:19:00

Last updated 6 years ago

2018-10-30 16:25:00

Affected Software

PHP 4.0.0

4.0

PHP PHP 4.0 Beta 1

4.0

PHP PHP 4.0 Beta 2

4.0

PHP PHP 4.0 Beta 3

4.0

PHP PHP 4.0 Beta 4

4.0

PHP PHP 4.0 Beta 4 Patch Level 1

4.0

PHP 4.0 Release Candidate 1

4.0

PHP 4.0 Release Candidate 2

4.0

PHP PHP 4.0.0

4.0.0

PHP PHP 4.0.1

4.0.1

PHP PHP 4.0.2

4.0.2

PHP PHP 4.0.3

4.0.3

PHP PHP 4.0.4

4.0.4

PHP PHP 4.0.5

4.0.5

PHP PHP 4.0.6

4.0.6

PHP PHP 4.0.7

4.0.7

PHP 4.0.7 Release Candidate 1

4.0.7

PHP 4.0.7 Release Candidate 2

4.0.7

PHP 4.0.7 Release Candidate 3

4.0.7

PHP PHP 4.1.0

4.1.0

PHP PHP 4.1.1

4.1.1

PHP PHP 4.1.2

4.1.2

PHP PHP 4.2.0

4.2.0

PHP PHP 4.2.1

4.2.1

PHP PHP 4.2.2

4.2.2

PHP PHP 4.2.3

4.2.3

PHP PHP 4.3.0

4.3.0

PHP PHP 4.3.1

4.3.1

PHP PHP 4.3.2

4.3.2

PHP PHP 4.3.3

4.3.3

PHP PHP 4.3.4

4.3.4

PHP PHP 4.3.5

4.3.5

PHP PHP 4.3.6

4.3.6

PHP PHP 4.3.7

4.3.7

PHP PHP 4.3.8

4.3.8

PHP PHP 4.3.9

4.3.9

PHP PHP 4.3.10

4.3.10

PHP PHP 4.3.11

4.3.11

PHP PHP 4.4.0

4.4.0

PHP PHP 4.4.1

4.4.1

PHP PHP 4.4.2

4.4.2

PHP PHP 4.4.3

4.4.3

PHP PHP 4.4.4

4.4.4

PHP PHP 4.4.5

4.4.5

PHP PHP 4.4.6

4.4.6

PHP PHP 5.0.0

5.0.0

PHP PHP 5.0.0 Beta1

5.0.0

PHP PHP 5.0.0 Beta2

5.0.0

PHP PHP 5.0.0 Beta3

5.0.0

PHP PHP 5.0.0 Beta4

5.0.0

PHP PHP 5.0.0 RC1

5.0.0

PHP PHP 5.0.0 RC2

5.0.0

PHP PHP 5.0.0 RC3

5.0.0

PHP PHP 5.0.1

5.0.1

PHP PHP 5.0.2

5.0.2

PHP PHP 5.0.3

5.0.3

PHP PHP 5.0.4

5.0.4

PHP PHP 5.0.5

5.0.5

PHP PHP 5.1.0

5.1.0

PHP PHP 5.1.1

5.1.1

PHP PHP 5.1.2

5.1.2

PHP PHP 5.1.3

5.1.3

PHP 5.1.4

5.1.4

PHP PHP 5.1.5

5.1.5

PHP PHP 5.1.6

5.1.6

PHP 5.2.0

5.2.0

PHP 5.2.1

5.2.1

References

http://docs.info.apple.com/article.html?artnum=306172

APPLE-SA-2007-07-31

RHSA-2007:0155

24909

24924

24945

24965

25056

25057

25062

25445

26235

GLSA-200705-19

http://us2.php.net/releases/4_4_7.php

http://us2.php.net/releases/5_2_2.php

DSA-1283

MDKSA-2007:088

MDKSA-2007:089

MDKSA-2007:090

SUSE-SA:2007:032

http://www.php-security.org/MOPB/MOPB-26-2007.html

Vendor Advisory

RHSA-2007:0153

RHSA-2007:0162

20070418 rPSA-2007-0073-1 php php-mysql php-pgsql

23016

25159

USN-455-1

ADV-2007-2732

https://issues.rpath.com/browse/RPL-1268

oval:org.mitre.oval:def:10245

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.