Vulnerability Name:

CVE-2007-1286 (CCN-32796)

Assigned:2007-03-02
Published:2007-03-02
Updated:2018-10-16
Summary:Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
CVSS v3 Severity:5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.6 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
4.2 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2007-1286

Source: HP
Type: UNKNOWN
SSRT071423

Source: HP
Type: UNKNOWN
HPSBTU02232

Source: CCN
Type: HP Security Bulletin HPSBTU02232 SSRT071429
Secure Web Server for HP Tru64 UNIX Powered by Apache (SWS) or HP Internet Express for Tru64 UNIX running PHP, Remote Arbitrary Code Execution, Unauthorized Disclosure of Information, or Denial of Service (DoS)

Source: CCN
Type: RHSA-2007-0154
Important: php security update

Source: REDHAT
Type: UNKNOWN
RHSA-2007:0154

Source: CCN
Type: RHSA-2007-0155
Important: php security update

Source: REDHAT
Type: UNKNOWN
RHSA-2007:0155

Source: CCN
Type: RHSA-2007-0163
Important: php security update for Stronghold

Source: REDHAT
Type: UNKNOWN
RHSA-2007:0163

Source: SECUNIA
Type: UNKNOWN
24419

Source: SECUNIA
Type: UNKNOWN
24606

Source: SECUNIA
Type: UNKNOWN
24910

Source: SECUNIA
Type: UNKNOWN
24924

Source: SECUNIA
Type: UNKNOWN
24941

Source: SECUNIA
Type: UNKNOWN
24945

Source: SECUNIA
Type: UNKNOWN
25025

Source: SECUNIA
Type: UNKNOWN
25062

Source: CCN
Type: SA25423
HP System Management Homepage PHP Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
25423

Source: SECUNIA
Type: UNKNOWN
25445

Source: CCN
Type: SA25850
HP Secure Web Server/Internet Express for Tru64 UNIX PHP Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
25850

Source: GENTOO
Type: UNKNOWN
GLSA-200703-21

Source: GENTOO
Type: UNKNOWN
GLSA-200705-19

Source: CCN
Type: ASA-2007-195
php security update (RHSA-2007-0154)

Source: CCN
Type: ASA-2007-196
php security update (RHSA-2007-0155)

Source: DEBIAN
Type: UNKNOWN
DSA-1282

Source: DEBIAN
Type: UNKNOWN
DSA-1283

Source: DEBIAN
Type: DSA-1282
php4 -- several vulnerabilities

Source: DEBIAN
Type: DSA-1283
php5 -- several vulnerabilities

Source: CCN
Type: GLSA-200703-21
PHP: Multiple vulnerabilities

Source: CCN
Type: GLSA-200705-19
PHP: Multiple vulnerabilities

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2007:087

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2007:088

Source: OSVDB
Type: UNKNOWN
32771

Source: CCN
Type: OSVDB ID: 32771
PHP unserialize() ZVAL Reference Counter Remote Overflow

Source: CCN
Type: MOPB-04-2007
PHP 4 unserialize() ZVAL Reference Counter Overflow

Source: MISC
Type: Exploit, Patch, Vendor Advisory
http://www.php-security.org/MOPB/MOPB-04-2007.html

Source: CCN
Type: PHP Web site
PHP: Hypertext Preprocessor

Source: BUGTRAQ
Type: UNKNOWN
20070418 rPSA-2007-0073-1 php php-mysql php-pgsql

Source: BID
Type: UNKNOWN
22765

Source: CCN
Type: BID-22765
PHP ZVAL Reference Counter Integer Overflow Vulnerability

Source: TRUSTIX
Type: UNKNOWN
2007-0009

Source: CCN
Type: TLSA-2007-29
Multiple vulnerabilities in php

Source: VUPEN
Type: UNKNOWN
ADV-2007-1991

Source: VUPEN
Type: UNKNOWN
ADV-2007-2374

Source: XF
Type: UNKNOWN
php-zval-code-execution(32796)

Source: XF
Type: UNKNOWN
php-zval-code-execution(32796)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-1268

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:11575

Source: CCN
Type: Rapid7 Vulnerability and Exploit Database [03-04-2007]
PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:php:*:*:*:*:*:*:*:* (Version <= 4.4.4)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:php:php:4.0.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.2.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.2.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.2.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.9:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.10:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.11:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.4.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.4.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.4.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.6:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0.7:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.1.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.1.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.2.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.6:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.7:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.3.8:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.4.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.4.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.0:rc2:*:*:*:*:*:*
  • AND
  • cpe:/a:redhat:stronghold:-:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:-:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:8:*:*:*:server:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:10:*:*:*:desktop:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:10:*:*:*:server:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:mandrakesoft:mandrake_multi_network_firewall:2.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:personal:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:multimedia:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:18873
    P
    		DSA-1282-1 php4
    2014-06-23
    oval:org.mitre.oval:def:19944
    P
    		DSA-1283-1 php5
    2014-06-23
    oval:org.mitre.oval:def:11575
    V
    		Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
    2013-04-29
    oval:org.debian:def:1283
    V
    		several vulnerabilities
    2007-04-29
    oval:org.debian:def:1282
    V
    		several vulnerabilities
    2007-04-26
    oval:com.redhat.rhsa:def:20070155
    P
    		RHSA-2007:0155: php security update (Important)
    2007-04-16
    BACK
    php php *
    php php 4.0.5
    php php 4.1.1
    php php 4.2.0
    php php 4.2.1
    php php 4.2.3
    php php 4.2.2
    php php 4.3.0
    php php 4.3.4
    php php 4.3.9
    php php 4.3.10
    php php 4.3.11
    php php 4.4.0
    php php 4.4.2
    php php 4.3.3
    php php 4.4.3
    php php 4.0.0
    php php 4.0.1
    php php 4.0.2
    php php 4.0.3
    php php 4.0.4
    php php 4.0.6
    php php 4.0.7
    php php 4.0 beta_4_patch1
    php php 4.0 beta1
    php php 4.0 beta2
    php php 4.0 beta3
    php php 4.0 beta4
    php php 4.1.0
    php php 4.1.2
    php php 4.1.0 -
    php php 4.2.0 -
    php php 4.3.1
    php php 4.3.2
    php php 4.3.5
    php php 4.3.6
    php php 4.3.7
    php php 4.3.8
    php php 4.4.1
    php php 4.4.4
    php php 4.0 rc1
    php php 4.0 rc2
    redhat stronghold -
    gentoo linux -
    turbolinux turbolinux 8
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    turbolinux turbolinux 10
    redhat enterprise linux 3
    turbolinux turbolinux 10
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    debian debian linux 3.1
    mandrakesoft mandrake multi network firewall 2.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 3.0
    turbolinux turbolinux *
    turbolinux turbolinux *
    turbolinux turbolinux *
    debian debian linux 4.0