CVE-2007-1700
Summary
| CVE | CVE-2007-1700 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-03-27 01:19:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION, which destroys the session data Hashtable. |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Php | Php | 4.0 | All | All | All |
| Application | Php | Php | 4.0 | beta1 | All | All |
| Application | Php | Php | 4.0 | beta2 | All | All |
| Application | Php | Php | 4.0 | beta3 | All | All |
| Application | Php | Php | 4.0 | beta4 | All | All |
| Application | Php | Php | 4.0 | beta_4_patch1 | All | All |
| Application | Php | Php | 4.0 | rc1 | All | All |
| Application | Php | Php | 4.0 | rc2 | All | All |
| Application | Php | Php | 4.0.0 | All | All | All |
| Application | Php | Php | 4.0.1 | All | All | All |
| Application | Php | Php | 4.0.1 | patch1 | All | All |
| Application | Php | Php | 4.0.1 | patch2 | All | All |
| Application | Php | Php | 4.0.2 | All | All | All |
| Application | Php | Php | 4.0.3 | All | All | All |
| Application | Php | Php | 4.0.3 | patch1 | All | All |
| Application | Php | Php | 4.0.4 | All | All | All |
| Application | Php | Php | 4.0.4 | patch1 | All | All |
| Application | Php | Php | 4.0.5 | All | All | All |
| Application | Php | Php | 4.0.6 | All | All | All |
| Application | Php | Php | 4.0.7 | All | All | All |
| Application | Php | Php | 4.0.7 | rc1 | All | All |
| Application | Php | Php | 4.0.7 | rc2 | All | All |
| Application | Php | Php | 4.0.7 | rc3 | All | All |
| Application | Php | Php | 4.1.0 | All | All | All |
| Application | Php | Php | 4.1.1 | All | All | All |
| Application | Php | Php | 4.1.2 | All | All | All |
| Application | Php | Php | 4.2 | All | dev | All |
| Application | Php | Php | 4.2.0 | All | All | All |
| Application | Php | Php | 4.2.1 | All | All | All |
| Application | Php | Php | 4.2.2 | All | All | All |
| Application | Php | Php | 4.2.3 | All | All | All |
| Application | Php | Php | 4.3.0 | All | All | All |
| Application | Php | Php | 4.3.1 | All | All | All |
| Application | Php | Php | 4.3.10 | All | All | All |
| Application | Php | Php | 4.3.11 | All | All | All |
| Application | Php | Php | 4.3.2 | All | All | All |
| Application | Php | Php | 4.3.3 | All | All | All |
| Application | Php | Php | 4.3.4 | All | All | All |
| Application | Php | Php | 4.3.5 | All | All | All |
| Application | Php | Php | 4.3.6 | All | All | All |
| Application | Php | Php | 4.3.7 | All | All | All |
| Application | Php | Php | 4.3.8 | All | All | All |
| Application | Php | Php | 4.3.9 | All | All | All |
| Application | Php | Php | 4.4.0 | All | All | All |
| Application | Php | Php | 4.4.1 | All | All | All |
| Application | Php | Php | 4.4.2 | All | All | All |
| Application | Php | Php | 4.4.3 | All | All | All |
| Application | Php | Php | 4.4.4 | All | All | All |
| Application | Php | Php | 5.0 | rc1 | All | All |
| Application | Php | Php | 5.0 | rc2 | All | All |
| Application | Php | Php | 5.0 | rc3 | All | All |
| Application | Php | Php | 5.0.0 | All | All | All |
| Application | Php | Php | 5.0.0 | beta1 | All | All |
| Application | Php | Php | 5.0.0 | beta2 | All | All |
| Application | Php | Php | 5.0.0 | beta3 | All | All |
| Application | Php | Php | 5.0.0 | beta4 | All | All |
| Application | Php | Php | 5.0.0 | rc1 | All | All |
| Application | Php | Php | 5.0.0 | rc2 | All | All |
| Application | Php | Php | 5.0.0 | rc3 | All | All |
| Application | Php | Php | 5.0.1 | All | All | All |
| Application | Php | Php | 5.0.2 | All | All | All |
| Application | Php | Php | 5.0.3 | All | All | All |
| Application | Php | Php | 5.0.4 | All | All | All |
| Application | Php | Php | 5.0.5 | All | All | All |
| Application | Php | Php | 5.1.0 | All | All | All |
| Application | Php | Php | 5.1.1 | All | All | All |
| Application | Php | Php | 5.1.2 | All | All | All |
| Application | Php | Php | 5.1.3 | All | All | All |
| Application | Php | Php | 5.1.4 | All | All | All |
| Application | Php | Php | 5.1.5 | All | All | All |
| Application | Php | Php | 5.1.6 | All | All | All |
| Application | Php | Php | 5.2.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| PHP Hash Table Overwrite Arbitrary Code Execution Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit |
| HP Secure Web Server/Internet Express for Tru64 UNIX PHP Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Gentoo Linux Documentation -- PHP: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| HPSBMA02215 SSRT071423 rev.1 - HP System Management Homepage (SMH) for Linux and Windows Running PHP, Remote Execution of Arbitrary Code - c01056506 - HP Business Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20000.www2.hp.com | |
| SUSE update for php - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| HP System Management Homepage PHP Multiple Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| USN-455-1: PHP vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| Debian update for php5 - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Gentoo update for php - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| MOPB-30-2007:PHP _SESSION unset() Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.php-security.org | |
| Ubuntu update for php - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| HPSBTU02232 SSRT071429 rev.1 - Secure Web Server for HP Tru64 UNIX Powered by Apache (SWS) or HP Internet Express for Tru64 UNIX running PHP, Remote Arbitrary Code Execution, Unauthorized Disclosure of Information, or Denial of Service (DoS) - c01086137 - HP Business Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20000.www2.hp.com | |
| Debian -- Security Information -- DSA-1283-1 php5 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2007-04-16 | Mark J Cox | The PHP interpreter does not offer a reliable "sandboxed" security layer (as found in, say, a JVM) in which untrusted scripts can be run; any script run by the PHP interpreter must be trusted with the privileges of the interpreter itself. We therefore do not classify this issue as security-sensitive since no trust boundary is crossed. |
There are currently no legacy QID mappings associated with this CVE.