PHP Session Data Deserialization Arbitrary Code Execution Vulnerability
BID:23120
Info
PHP Session Data Deserialization Arbitrary Code Execution Vulnerability
| Bugtraq ID: | 23120 |
| Class: | Design Error |
| CVE: |
CVE-2007-1701 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 24 2007 12:00AM |
| Updated: | Jun 29 2007 05:08PM |
| Credit: | Stefan Esser is credited with the discovery of this vulnerability. |
| Vulnerable: |
PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 -RC1 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 PHP PHP 4.3.9 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.2 -dev PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 PHP PHP 4.0.7 RC3 PHP PHP 4.0.7 RC2 PHP PHP 4.0.7 RC1 PHP PHP 4.0.7 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 pl1 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 PHP PHP 4.0 0 PHP PHP 5.2 HP Tru64 UNIX Compaq Secure Web Server 6.3.2 a HP Tru64 UNIX Compaq Secure Web Server 6.3 HP Tru64 UNIX Compaq Secure Web Server 5.9.2 HP Tru64 UNIX Compaq Secure Web Server 5.9.1 HP Tru64 UNIX Compaq Secure Web Server 5.8.2 HP Tru64 UNIX Compaq Secure Web Server 5.8.1 HP Tru64 UNIX Compaq Secure Web Server 5.1 A HP Tru64 UNIX Compaq Secure Web Server 5.1 HP Tru64 UNIX Compaq Secure Web Server 5.0 A HP Tru64 UNIX Compaq Secure Web Server 4.0 G HP Tru64 UNIX Compaq Secure Web Server 4.0 F HP Systems Management HomePage 2.1.7.168 HP System Management Homepage 2.1.5 HP System Management Homepage 2.1.4 HP System Management Homepage 2.1.3 .132 HP System Management Homepage 2.1.3 HP System Management Homepage 2.1.2 HP System Management Homepage 2.1.1 HP System Management Homepage 2.1 HP System Management Homepage 2.0.2 HP System Management Homepage 2.0.1 HP System Management Homepage 2.0 HP Secure Web Server for HP Tru64 UNIX 6.6.4 HP Internet Express 6.0 HP Internet Express 5.9 HP Internet Express 5.8 HP Internet Express 5.7 HP Internet Express 5.4 HP Internet Express 6.6 HP Internet Express 6.4 HP Internet Express 6.3 Gentoo Linux |
| Not Vulnerable: |
HP Systems Management HomePage 2.1.8 HP Internet Express 6.7 |
Discussion
PHP Session Data Deserialization Arbitrary Code Execution Vulnerability
PHP is prone to an arbitrary-code-execution vulnerability.
An attacker may exploit this issue to execute arbitrary code within the context of the affected webserver.
This issue affects PHP 4 versions prior to 4.4.5 and PHP 5 versions prior to 5.2.1.
PHP is prone to an arbitrary-code-execution vulnerability.
An attacker may exploit this issue to execute arbitrary code within the context of the affected webserver.
This issue affects PHP 4 versions prior to 4.4.5 and PHP 5 versions prior to 5.2.1.
Exploit / POC
PHP Session Data Deserialization Arbitrary Code Execution Vulnerability
The following exploit code is available:
The following exploit code is available:
Solution / Fix
PHP Session Data Deserialization Arbitrary Code Execution Vulnerability
Solution:
Please see the references for more information.
HP Systems Management HomePage 2.1.7.168
HP Secure Web Server for HP Tru64 UNIX 6.6.4
Solution:
Please see the references for more information.
HP Systems Management HomePage 2.1.7.168
-
HP HP System Management Homepage for Linux
http://h18023.www1.hp.com/support/files/server/us/download/26864.html -
HP HP System Management Homepage for Linux (AMD64/EM64T)
http://h18023.www1.hp.com/support/files/server/us/download/26866.html -
HP HP System Management Homepage for Windows
http://h18023.www1.hp.com/support/files/server/us/download/26977.html
HP Secure Web Server for HP Tru64 UNIX 6.6.4
-
HP sws_v6_6_5_kit.tar.gz
http://h30097.www3.hp.com/internet/download.htm#sws
References
PHP Session Data Deserialization Arbitrary Code Execution Vulnerability
References:
References:
- HPSBMA02215 SSRT071423 (HP)
- MOPB-31-2007:PHP _SESSION Deserialization Overwrite Vulnerability (Stefan Esser)
- PHP Homepage (PHP)