// For flags

CVE-2007-1583

PHP 5.1.6 - Mb_Parse_Str Function Register_Globals Activation

Severity Score

6.8
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.

La función mb_parse_str del PHP 4.0.0 hasta la 4.4.6 y de la 5.0.0 hasta la 5.2.1 establece la bandera interna del registro global y no la deshabilita en ciertos casos cuando la secuencia de comandos termina, lo que permite a atacantes remotos invocar secuencias de comandos PHP disponibles con la funcionalidad del registro global, lo que no es detectado por estas secuencias de comandos, como lo demostrado forzando una violación del límite de memoria.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-03-19 First Exploit
  • 2007-03-21 CVE Reserved
  • 2007-03-21 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-08-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
CAPEC
References (33)
URL Tag Source
http://docs.info.apple.com/article.html?artnum=306172 X_refsource_confirm
http://secunia.com/advisories/24909 Third Party Advisory
http://secunia.com/advisories/24924 Third Party Advisory
http://secunia.com/advisories/24945 Third Party Advisory
http://secunia.com/advisories/24965 Third Party Advisory
http://secunia.com/advisories/25056 Third Party Advisory
http://secunia.com/advisories/25057 Third Party Advisory
http://secunia.com/advisories/25062 Third Party Advisory
http://secunia.com/advisories/25445 Third Party Advisory
http://secunia.com/advisories/26235 Third Party Advisory
http://us2.php.net/releases/4_4_7.php X_refsource_confirm
http://us2.php.net/releases/5_2_2.php X_refsource_confirm
http://www.securityfocus.com/archive/1/466166/100/0/threaded Mailing List
http://www.securityfocus.com/bid/23016 Vdb Entry
http://www.securityfocus.com/bid/25159 Vdb Entry
http://www.vupen.com/english/advisories/2007/2732 Vdb Entry
https://issues.rpath.com/browse/RPL-1268 X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10245 Signature
URL Date SRC
https://www.exploit-db.com/exploits/29752 2007-03-19
URL Date SRC
URL Date SRC
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html 2018-10-30
http://rhn.redhat.com/errata/RHSA-2007-0155.html 2018-10-30
http://security.gentoo.org/glsa/glsa-200705-19.xml 2018-10-30
http://www.debian.org/security/2007/dsa-1283 2018-10-30
http://www.mandriva.com/security/advisories?name=MDKSA-2007:088 2018-10-30
http://www.mandriva.com/security/advisories?name=MDKSA-2007:089 2018-10-30
http://www.mandriva.com/security/advisories?name=MDKSA-2007:090 2018-10-30
http://www.novell.com/linux/security/advisories/2007_32_php.html 2018-10-30
http://www.php-security.org/MOPB/MOPB-26-2007.html 2018-10-30
http://www.redhat.com/support/errata/RHSA-2007-0153.html 2018-10-30
http://www.redhat.com/support/errata/RHSA-2007-0162.html 2018-10-30
http://www.ubuntu.com/usn/usn-455-1 2018-10-30
https://access.redhat.com/security/cve/CVE-2007-1583 2007-04-16
https://bugzilla.redhat.com/show_bug.cgi?id=1618303 2007-04-16
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
beta_4_patch1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
beta1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
beta2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
beta3
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
beta4
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
rc1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
rc2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.0
Search vendor "Php" for product "Php" and version "4.0.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.1
Search vendor "Php" for product "Php" and version "4.0.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.1
Search vendor "Php" for product "Php" and version "4.0.1"
patch1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.1
Search vendor "Php" for product "Php" and version "4.0.1"
patch2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.2
Search vendor "Php" for product "Php" and version "4.0.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.3
Search vendor "Php" for product "Php" and version "4.0.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.3
Search vendor "Php" for product "Php" and version "4.0.3"
patch1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.4
Search vendor "Php" for product "Php" and version "4.0.4"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.4
Search vendor "Php" for product "Php" and version "4.0.4"
patch1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.5
Search vendor "Php" for product "Php" and version "4.0.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.6
Search vendor "Php" for product "Php" and version "4.0.6"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.7
Search vendor "Php" for product "Php" and version "4.0.7"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.7
Search vendor "Php" for product "Php" and version "4.0.7"
rc1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.7
Search vendor "Php" for product "Php" and version "4.0.7"
rc2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.7
Search vendor "Php" for product "Php" and version "4.0.7"
rc3
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.1.0
Search vendor "Php" for product "Php" and version "4.1.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.1.1
Search vendor "Php" for product "Php" and version "4.1.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.1.2
Search vendor "Php" for product "Php" and version "4.1.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2
Search vendor "Php" for product "Php" and version "4.2"
dev
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2.0
Search vendor "Php" for product "Php" and version "4.2.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2.1
Search vendor "Php" for product "Php" and version "4.2.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2.2
Search vendor "Php" for product "Php" and version "4.2.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2.3
Search vendor "Php" for product "Php" and version "4.2.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.0
Search vendor "Php" for product "Php" and version "4.3.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.1
Search vendor "Php" for product "Php" and version "4.3.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.2
Search vendor "Php" for product "Php" and version "4.3.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.3
Search vendor "Php" for product "Php" and version "4.3.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.4
Search vendor "Php" for product "Php" and version "4.3.4"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.5
Search vendor "Php" for product "Php" and version "4.3.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.6
Search vendor "Php" for product "Php" and version "4.3.6"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.7
Search vendor "Php" for product "Php" and version "4.3.7"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.8
Search vendor "Php" for product "Php" and version "4.3.8"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.9
Search vendor "Php" for product "Php" and version "4.3.9"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.10
Search vendor "Php" for product "Php" and version "4.3.10"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.3.11
Search vendor "Php" for product "Php" and version "4.3.11"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.4.0
Search vendor "Php" for product "Php" and version "4.4.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.4.1
Search vendor "Php" for product "Php" and version "4.4.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.4.2
Search vendor "Php" for product "Php" and version "4.4.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.4.3
Search vendor "Php" for product "Php" and version "4.4.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.4.4
Search vendor "Php" for product "Php" and version "4.4.4"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.4.5
Search vendor "Php" for product "Php" and version "4.4.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.4.6
Search vendor "Php" for product "Php" and version "4.4.6"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0
Search vendor "Php" for product "Php" and version "5.0"
rc1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0
Search vendor "Php" for product "Php" and version "5.0"
rc2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0
Search vendor "Php" for product "Php" and version "5.0"
rc3
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
beta1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
beta2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
beta3
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
beta4
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
rc1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
rc2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
rc3
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.1
Search vendor "Php" for product "Php" and version "5.0.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.2
Search vendor "Php" for product "Php" and version "5.0.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.3
Search vendor "Php" for product "Php" and version "5.0.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.4
Search vendor "Php" for product "Php" and version "5.0.4"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.5
Search vendor "Php" for product "Php" and version "5.0.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.0
Search vendor "Php" for product "Php" and version "5.1.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.1
Search vendor "Php" for product "Php" and version "5.1.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.2
Search vendor "Php" for product "Php" and version "5.1.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.3
Search vendor "Php" for product "Php" and version "5.1.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.4
Search vendor "Php" for product "Php" and version "5.1.4"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.5
Search vendor "Php" for product "Php" and version "5.1.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.6
Search vendor "Php" for product "Php" and version "5.1.6"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.2.0
Search vendor "Php" for product "Php" and version "5.2.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.2.1
Search vendor "Php" for product "Php" and version "5.2.1"
-
Affected