#VU110502 Input validation error in PHP - CVE-2005-3390
Vulnerability identifier: #VU110502
Vulnerability risk: Medium
CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
PHP
Universal components / Libraries /
Scripting languages
Vendor: PHP Group
Description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.
Mitigation
Install update from vendor's website.
Vulnerable software versions
PHP: 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.1, 4.1.1, 4.1.2, 4.2, 4.2.1, 4.2.2, 4.2.3, 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4, 5, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5
External links
https://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
https://rhn.redhat.com/errata/RHSA-2006-0549.html
https://secunia.com/advisories/17371
https://secunia.com/advisories/17490
https://secunia.com/advisories/17510
https://secunia.com/advisories/17531
https://secunia.com/advisories/17557
https://secunia.com/advisories/17559
https://secunia.com/advisories/18054
https://secunia.com/advisories/18198
https://secunia.com/advisories/18669
https://secunia.com/advisories/21252
https://secunia.com/advisories/22691
https://securityreason.com/securityalert/132
https://securitytracker.com/id?1015129
https://support.avaya.com/elmodocs2/security/ASA-2006-037.htm
https://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html
https://www.gentoo.org/security/en/glsa/glsa-200511-08.xml
https://www.hardened-php.net/advisory_202005.79.html
https://www.hardened-php.net/globals-problem
https://www.mandriva.com/security/advisories?name=MDKSA-2005:213
https://www.novell.com/linux/security/advisories/2005_27_sr.html
https://www.openpkg.org/security/OpenPKG-SA-2005.027-php.html
https://www.php.net/release_4_4_1.php
https://www.redhat.com/support/errata/RHSA-2005-831.html
https://www.redhat.com/support/errata/RHSA-2005-838.html
https://www.securityfocus.com/archive/1/415290/30/0/threaded
https://www.securityfocus.com/archive/1/419504/100/0/threaded
https://www.securityfocus.com/bid/15250
https://www.vupen.com/english/advisories/2005/2254
https://www.vupen.com/english/advisories/2006/4320
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10537
https://www.ubuntu.com/usn/usn-232-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
