Vulnerability Name:

CVE-2007-4657 (CCN-36388)

Assigned:2007-08-30
Published:2007-08-30
Updated:2018-10-26
Summary:Multiple integer overflows in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to obtain sensitive information (memory contents) or cause a denial of service (thread crash) via a large len value to the (1) strspn or (2) strcspn function, which triggers an out-of-bounds read.
Note: this affects different product versions than CVE-2007-3996.
CVSS v3 Severity:5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
3.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-189
CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2007-4657

Source: CCN
Type: SA26442
Infrant ReadyNAS Devices SSH Default Root Password Weakness

Source: CCN
Type: SA26642
PHP Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
26642

Source: SECUNIA
Type: Third Party Advisory
26822

Source: SECUNIA
Type: Third Party Advisory
26838

Source: SECUNIA
Type: Third Party Advisory
27102

Source: SECUNIA
Type: Third Party Advisory
27377

Source: SECUNIA
Type: Third Party Advisory
27864

Source: SECUNIA
Type: Third Party Advisory
28249

Source: CCN
Type: SA28318
PHP Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
28318

Source: SECUNIA
Type: Third Party Advisory
28936

Source: SECUNIA
Type: Third Party Advisory
30288

Source: MISC
Type: Third Party Advisory
http://secweb.se/en/advisories/php-strcspn-information-leak-vulnerability/

Source: SLACKWARE
Type: Mailing List, Third Party Advisory
SSA:2008-045-03

Source: DEBIAN
Type: Third Party Advisory
DSA-1444

Source: DEBIAN
Type: Third Party Advisory
DSA-1578

Source: DEBIAN
Type: DSA-1444
php5 -- several vulnerabilities

Source: DEBIAN
Type: DSA-1578
php4 -- several vulnerabilities

Source: CCN
Type: GLSA-200710-02
PHP: Multiple vulnerabilities

Source: GENTOO
Type: Third Party Advisory
GLSA-200710-02

Source: CONFIRM
Type: Vendor Advisory
http://www.php.net/ChangeLog-4.php

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.php.net/ChangeLog-5.php#5.2.4

Source: CONFIRM
Type: Vendor Advisory
http://www.php.net/releases/4_4_8.php

Source: CCN
Type: PHP Web site
PHP 5.2.4 Release Announcement

Source: CONFIRM
Type: Vendor Advisory
http://www.php.net/releases/5_2_4.php

Source: TRUSTIX
Type: Broken Link
2007-0026

Source: CCN
Type: USN-549-1
PHP vulnerabilities

Source: CCN
Type: USN-549-2
PHP regression

Source: UBUNTU
Type: Broken Link
USN-549-2

Source: VUPEN
Type: Third Party Advisory
ADV-2007-3023

Source: VUPEN
Type: Third Party Advisory
ADV-2008-0059

Source: XF
Type: Third Party Advisory, VDB Entry
php-strcspn-overflow(36388)

Source: XF
Type: UNKNOWN
php-strcspn-overflow(36388)

Source: XF
Type: Third Party Advisory, VDB Entry
php-strcspn-strspn-unspecified(39399)

Source: CONFIRM
Type: Broken Link
https://issues.rpath.com/browse/RPL-1693

Source: CONFIRM
Type: Broken Link
https://issues.rpath.com/browse/RPL-1702

Source: CONFIRM
Type: Third Party Advisory
https://launchpad.net/bugs/173043

Source: UBUNTU
Type: Third Party Advisory
USN-549-1

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:php:*:*:*:*:*:*:*:* (Version >= 4.0.0 and < 4.4.8)
  • OR cpe:/a:php:php:*:*:*:*:*:*:*:* (Version >= 5.0.0 and < 5.2.4)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:php:php:5.0.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.0.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.1.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.2:-:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:8065
    P
    		DSA-1578 php4 -- several vulnerabilities
    2015-02-23
    oval:org.mitre.oval:def:16967
    P
    		USN-549-2 -- php5 regression
    2014-06-30
    oval:org.mitre.oval:def:17624
    P
    		USN-549-1 -- php5 vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:20198
    P
    		DSA-1444-1 php5 several issues
    2014-06-23
    oval:org.mitre.oval:def:7538
    P
    		DSA-1444 php5 -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:18224
    P
    		DSA-1578-1 php4 - several vulnerabilities
    2014-06-23
    oval:org.debian:def:1578
    V
    		several vulnerabilities
    2008-05-17
    oval:org.debian:def:1444
    V
    		several vulnerabilities
    2008-01-23
    BACK
    php php *
    php php *
    debian debian linux 3.1
    debian debian linux 4.0
    canonical ubuntu linux 6.06
    canonical ubuntu linux 6.10
    canonical ubuntu linux 7.04
    canonical ubuntu linux 7.10
    php php 5.0.3
    php php 5.0.4
    php php 5.0.0
    php php 5.0.5
    php php 5.1.1
    php php 5.1.2
    php php 5.1.4
    php php 5.0.2
    php php 5.1.6
    php php 5.2.0
    php php 5.2.1
    php php 5.2.3
    php php 5.0.0 beta1
    php php 5.0.0 beta2
    php php 5.0.0 beta3
    php php 5.0.0 beta4
    php php 5.0.0 rc1
    php php 5.0.0 rc2
    php php 5.0.0 rc3
    php php 5.0.1
    php php 5.1.0
    php php 5.1.3
    php php 5.1.5
    php php 5.2.2
    gentoo linux *
    canonical ubuntu 6.06
    debian debian linux 4.0
    canonical ubuntu 7.04
    canonical ubuntu 7.10