ID CVE-2007-3806
Summary The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
References
Vulnerable Configurations
  • PHP 5.2.3
    cpe:2.3:a:php:php:5.2.3
CVSS
Base: 6.8 (as of 18-07-2007 - 18:58)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
exploit-db via4
description PHP 5.2.3 glob() Denial of Service Exploit. CVE-2007-3806. Dos exploits for multiple platform
file exploits/multiple/dos/4181.php
id EDB-ID:4181
last seen 2016-01-31
modified 2007-07-14
platform multiple
port
published 2007-07-14
reporter shinnai
source https://www.exploit-db.com/download/4181/
title PHP 5.2.3 glob Denial of Service Exploit
type dos
nessus via4
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1578.NASL
    description Several vulnerabilities have been discovered in PHP version 4, a server-side, HTML-embedded scripting language. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3799 The session_start function allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from various parameters. - CVE-2007-3806 A denial of service was possible through a malicious script abusing the glob() function. - CVE-2007-3998 Certain maliciously constructed input to the wordwrap() function could lead to a denial of service attack. - CVE-2007-4657 Large len values of the stspn() or strcspn() functions could allow an attacker to trigger integer overflows to expose memory or cause denial of service. - CVE-2008-2051 The escapeshellcmd API function could be attacked via incomplete multibyte chars.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 32379
    published 2008-05-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=32379
    title Debian DSA-1578-1 : php4 - several vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1572.NASL
    description Several vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3806 The glob function allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter. - CVE-2008-1384 Integer overflow allows context-dependent attackers to cause a denial of service and possibly have other impact via a printf format parameter with a large width specifier. - CVE-2008-2050 Stack-based buffer overflow in the FastCGI SAPI. - CVE-2008-2051 The escapeshellcmd API function could be attacked via incomplete multibyte chars.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 32306
    published 2008-05-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=32306
    title Debian DSA-1572-1 : php5 - several vulnerabilities
  • NASL family CGI abuses
    NASL id PHP_5_2_4.NASL
    description According to its banner, the version of PHP installed on the remote host is older than 5.2.4. Such versions may be affected by various issues, including but not limited to several overflows.
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 25971
    published 2007-09-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25971
    title PHP < 5.2.4 Multiple Vulnerabilities
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_71D903FC602D11DC898C001921AB2FA4.NASL
    description The PHP development team reports : Security Enhancements and Fixes in PHP 5.2.4 : - Fixed a floating point exception inside wordwrap() (Reported by Mattias Bengtsson) - Fixed several integer overflows inside the GD extension (Reported by Mattias Bengtsson) - Fixed size calculation in chunk_split() (Reported by Gerhard Wagner) - Fixed integer overflow in str[c]spn(). (Reported by Mattias Bengtsson) - Fixed money_format() not to accept multiple %i or %n tokens. (Reported by Stanislav Malyshev) - Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Reported by Stefan Esser) - Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Reported by Mattias Bengtsson) - Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian Arciemowicz) - Fixed a possible invalid read in glob() win32 implementation (CVE-2007-3806) (Reported by shinnai) - Fixed a possible buffer overflow in php_openssl_make_REQ (Reported by zatanzlatan at hotbrev dot com) - Fixed an open_basedir bypass inside glob() function (Reported by dr at peytz dot dk) - Fixed a possible open_basedir bypass inside session extension when the session file is a symlink (Reported by c dot i dot morris at durham dot ac dot uk) - Improved fix for MOPB-03-2007. - Corrected fix for CVE-2007-2872.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 26038
    published 2007-09-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=26038
    title FreeBSD : php -- multiple vulnerabilities (71d903fc-602d-11dc-898c-001921ab2fa4)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200710-02.NASL
    description The remote host is affected by the vulnerability described in GLSA-200710-02 (PHP: Multiple vulnerabilities) Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip Olausson reported integer overflows in the gdImageCreate() and gdImageCreateTrueColor() functions of the GD library which can cause heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered an integer overflow in the chunk_split() function that can lead to a heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused incorrect buffer size calculation due to precision loss, also resulting in a possible heap-based buffer overflow (CVE-2007-4661 and CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1 was not fixed correctly (CVE-2007-1887). Stefan Esser discovered an error in the zend_alter_ini_entry() function handling a memory_limit violation (CVE-2007-4659). Stefan Esser also discovered a flaw when handling interruptions with userspace error handlers that can be exploited to read arbitrary heap memory (CVE-2007-1883). Disclosure of sensitive memory can also be triggered due to insufficient boundary checks in the strspn() and strcspn() functions, an issue discovered by Mattias Bengtsson and Philip Olausson (CVE-2007-4657) Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL filter of the Filter extension allowing arbitrary email header injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed in GLSA 200705-19. Stanislav Malyshev found an error with unknown impact in the money_format() function when processing '%i' and '%n' tokens (CVE-2007-4658). zatanzlatan reported a buffer overflow in the php_openssl_make_REQ() function with unknown impact when providing a manipulated SSL configuration file (CVE-2007-4662). Possible memory corruption when trying to read EXIF data in exif_read_data() and exif_thumbnail() occurred with unknown impact. Several vulnerabilities that allow bypassing of open_basedir and other restrictions were reported, including the glob() function (CVE-2007-4663), the session_save_path(), ini_set(), and error_log() functions which can allow local command execution (CVE-2007-3378), involving the readfile() function (CVE-2007-3007), via the Session extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and in the dl() function which allows loading extensions outside of the specified directory (CVE-2007-4825). Multiple Denial of Service vulnerabilities were discovered, including a long 'library' parameter in the dl() function (CVE-2007-4887), in several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783), in the setlocale() function (CVE-2007-4784), in the glob() and fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point exception in the wordwrap() function (CVE-2007-3998), a stack exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop caused by a specially crafted PNG image in the png_read_info() function of libpng (CVE-2007-2756) and several issues related to array conversion. Impact : Remote attackers might be able to exploit these issues in PHP applications making use of the affected functions, potentially resulting in the execution of arbitrary code, Denial of Service, execution of scripted contents in the context of the affected site, security bypass or information leak. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-11-14
    plugin id 26942
    published 2007-10-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=26942
    title GLSA-200710-02 : PHP: Multiple vulnerabilities
refmap via4
bid
  • 24922
  • 25498
confirm
debian
  • DSA-1572
  • DSA-1578
exploit-db 4181
gentoo GLSA-200710-02
misc
osvdb 36085
secunia
  • 26085
  • 26642
  • 27102
  • 30158
  • 30288
vupen ADV-2007-2547
xf php-glob-security-bypass(35437)
statements via4
contributor Mark J Cox
lastmodified 2007-09-05
organization Red Hat
statement Not vulnerable. This issue only affected PHP on Windows platforms.
Last major update 05-11-2012 - 22:43
Published 16-07-2007 - 20:30
Last modified 28-09-2017 - 21:29
Back to Top