[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96125

 
 

909

 
 

78020

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2007-0908

Date: (C)2007-02-13   (M)2017-10-12
 
CVSS Score: 5.0Access Vector: NETWORK
Exploitability Subscore: 10.0Access Complexity: LOW
Impact Subscore: 2.9Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: NONE
 Availability: NONE











The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.

Reference:
SECTRACK-1017671
2007-0009
20070201-01-P
http://www.securityfocus.com/archive/1/archive/1/461462/100/0/threaded
BID-22496
BID-22806
SREASON-2321
SECUNIA-24089
SECUNIA-24195
SECUNIA-24217
SECUNIA-24236
SECUNIA-24248
SECUNIA-24284
SECUNIA-24295
SECUNIA-24322
SECUNIA-24419
SECUNIA-24421
SECUNIA-24432
SECUNIA-24514
SECUNIA-24606
SECUNIA-24642
OSVDB-32766
ADV-2007-0546
DSA-1264
GLSA-200703-21
MDKSA-2007:048
OpenPKG-SA-2007.010
RHSA-2007:0076
RHSA-2007:0081
RHSA-2007:0082
RHSA-2007:0088
RHSA-2007:0089
SUSE-SA:2007:020
USN-424-1
USN-424-2
http://support.avaya.com/elmodocs2/security/ASA-2007-101.htm
http://support.avaya.com/elmodocs2/security/ASA-2007-136.htm
http://www.php-security.org/MOPB/MOPB-11-2007.html
http://www.php.net/ChangeLog-5.php#5.2.1
http://www.php.net/releases/5_2_1.php
https://issues.rpath.com/browse/RPL-1088
php-wddx-information-disclosure(32493)

CPE    55
cpe:/a:php:php:4.0
cpe:/a:php:php:4.0.7
cpe:/a:php:php:4.0.6
cpe:/a:php:php:4.0.3
...
CWE    1
CWE-20

© 2013 SecPod Technologies