Vulnerability Name:

CVE-2007-1886 (CCN-33768)

Assigned:2007-03-31
Published:2007-03-31
Updated:2017-07-29
Summary:Integer overflow in the str_replace function in PHP 4.4.5 and PHP 5.2.1 allows context-dependent attackers to have an unknown impact via a single character search string in conjunction with a single character replacement string, which causes an "off by one overflow."
CVSS v3 Severity:5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
3.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2007-1886

Source: HP
Type: UNKNOWN
SSRT071423

Source: HP
Type: UNKNOWN
HPSBTU02232

Source: CCN
Type: HP Security Bulletin HPSBTU02232 SSRT071429
Secure Web Server for HP Tru64 UNIX Powered by Apache (SWS) or HP Internet Express for Tru64 UNIX running PHP, Remote Arbitrary Code Execution, Unauthorized Disclosure of Information, or Denial of Service (DoS)

Source: CCN
Type: SA25423
HP System Management Homepage PHP Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
25423

Source: CCN
Type: SA25850
HP Secure Web Server/Internet Express for Tru64 UNIX PHP Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
25850

Source: CCN
Type: MOPB-39-2007
PHP str_replace() Memory Allocation Integer Overflow Vulnerability

Source: MISC
Type: Patch, Vendor Advisory
http://www.php-security.org/MOPB/MOPB-39-2007.html

Source: CCN
Type: The PHP Group Web site
PHP: Hypertext Preprocessor

Source: VUPEN
Type: UNKNOWN
ADV-2007-1991

Source: VUPEN
Type: UNKNOWN
ADV-2007-2374

Source: XF
Type: UNKNOWN
php-strreplace-single-unspecified(33768)

Source: XF
Type: UNKNOWN
php-strreplace-single-unspecified(33768)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:php:4.4.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.1:-:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:php:php:5.2.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:4.4.5:-:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    php php 4.4.5
    php php 5.2.1
    php php 5.2.1
    php php 4.4.5