PHP 'EXTR_OVERWRITE' Parameter Security-Bypass Vulnerability
BID:46448
Info
PHP 'EXTR_OVERWRITE' Parameter Security-Bypass Vulnerability
| Bugtraq ID: | 46448 |
| Class: | Design Error |
| CVE: |
CVE-2011-0752 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 08 2010 12:00AM |
| Updated: | Apr 17 2012 05:50PM |
| Credit: | Pierre Joye |
| Vulnerable: |
SuSE SUSE Linux Enterprise 11 SP1 SuSE SUSE Linux Enterprise 10 SP4 SuSE SUSE Linux Enterprise 10 SP3 SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.2.13 PHP PHP 5.2.12 PHP PHP 5.2.11 PHP PHP 5.2.10 PHP PHP 5.2.9 PHP PHP 5.2.8 PHP PHP 5.2.7 PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4 PHP PHP 5.2.3 PHP PHP 5.2.2 PHP PHP 5.2.1 PHP PHP 5.3.3 PHP PHP 5.2.14 PHP PHP 5.2 HP OpenVMS Secure Web Server 7.3 -2 HP OpenVMS Secure Web Server 7.3 -1 HP OpenVMS Secure Web Server 7.3 HP OpenVMS Secure Web Server 7.2 -2 HP OpenVMS Secure Web Server 1.2 HP OpenVMS Secure Web Server 1.1 -1 HP OpenVMS Secure Web Server 2.2 HP OpenVMS Secure Web Server 2.1-1 |
| Not Vulnerable: |
PHP PHP 5.2.15 |
Discussion
PHP 'EXTR_OVERWRITE' Parameter Security-Bypass Vulnerability
PHP is prone to a security-bypass vulnerability
Successful exploits will allow attackers to bypass certain security restrictions and overwrite certain super global variables. This may aid in further attacks.
This issue affect the following versions of PHP:
5.2 (prior to 5.2.15)
PHP is prone to a security-bypass vulnerability
Successful exploits will allow attackers to bypass certain security restrictions and overwrite certain super global variables. This may aid in further attacks.
This issue affect the following versions of PHP:
5.2 (prior to 5.2.15)
Exploit / POC
PHP 'EXTR_OVERWRITE' Parameter Security-Bypass Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
PHP 'EXTR_OVERWRITE' Parameter Security-Bypass Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
PHP 'EXTR_OVERWRITE' Parameter Security-Bypass Vulnerability
References:
References: