Executive Summary

Informations
NameCVE-2007-1285First vendor Publication2007-03-06
VendorCveLast vendor Modification2010-11-30

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score5Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1285

CAPEC : Common Attack Pattern Enumeration & Classification

idName
CAPEC-82Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Servi...
CAPEC-99XML Parser Attack

CWE : Common Weakness Enumeration

idName
CWE-674Uncontrolled Recursion
CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11017
 
Oval ID: oval:org.mitre.oval:def:11017
Title: The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.
Description: The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.
Family: unix Class: vulnerability
Reference(s): CVE-2007-1285
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application57
Application1

OpenVAS Exploits

DateDescription
2010-04-23Name : PHP 5.2.0 and Prior Versions Multiple Vulnerabilities
File : nvt/gb_php_22496.nasl
2009-10-10Name : SLES9: Security update for PHP4
File : nvt/sles9p5012110.nasl
2009-04-09Name : Mandriva Update for php MDKSA-2007:089 (php)
File : nvt/gb_mandriva_MDKSA_2007_089.nasl
2009-04-09Name : Mandriva Update for php MDKSA-2007:090 (php)
File : nvt/gb_mandriva_MDKSA_2007_090.nasl
2009-03-23Name : Ubuntu Update for php5 vulnerabilities USN-549-1
File : nvt/gb_ubuntu_USN_549_1.nasl
2009-03-23Name : Ubuntu Update for php5 regression USN-549-2
File : nvt/gb_ubuntu_USN_549_2.nasl
2009-02-27Name : Fedora Update for php FEDORA-2007-415
File : nvt/gb_fedora_2007_415_php_fc6.nasl
2009-02-27Name : Fedora Update for php FEDORA-2007-455
File : nvt/gb_fedora_2007_455_php_fc5.nasl
2009-02-27Name : Fedora Update for php FEDORA-2007-526
File : nvt/gb_fedora_2007_526_php_fc5.nasl
2008-09-24Name : Gentoo Security Advisory GLSA 200705-19 (php)
File : nvt/glsa_200705_19.nasl
0000-00-00Name : Slackware Advisory SSA:2008-045-03 php
File : nvt/esoft_slk_ssa_2008_045_03.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
32769PHP Zend Engine Variable Destruction Deep Recursion Overflow

Nessus® Vulnerability Scanner

DateDescription
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2007-0155.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-090.nasl - Type : ACT_GATHER_INFO
2008-02-18Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2008-045-03.nasl - Type : ACT_GATHER_INFO
2007-12-13Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_php5-3754.nasl - Type : ACT_GATHER_INFO
2007-12-04Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-549-2.nasl - Type : ACT_GATHER_INFO
2007-11-30Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-549-1.nasl - Type : ACT_GATHER_INFO
2007-10-17Name : The remote SuSE system is missing the security patch php5-3745
File : suse_php5-3745.nasl - Type : ACT_GATHER_INFO
2007-10-17Name : The remote SuSE system is missing the security patch php5-3753
File : suse_php5-3753.nasl - Type : ACT_GATHER_INFO
2007-05-29Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200705-19.nasl - Type : ACT_GATHER_INFO
2007-05-25Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0082.nasl - Type : ACT_GATHER_INFO
2007-05-04Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_4_4_7_or_5_2_2.nasl - Type : ACT_GATHER_INFO
2007-04-30Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-455.nasl - Type : ACT_GATHER_INFO
2007-04-30Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2007-089.nasl - Type : ACT_GATHER_INFO
2007-04-19Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2007-0155.nasl - Type : ACT_GATHER_INFO
2007-04-19Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-415.nasl - Type : ACT_GATHER_INFO
2007-04-19Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0154.nasl - Type : ACT_GATHER_INFO
2007-04-19Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0155.nasl - Type : ACT_GATHER_INFO

Internal Sources (Detail)

SourceUrl
BIDhttp://www.securityfocus.com/bid/22764
BUGTRAQhttp://www.securityfocus.com/archive/1/archive/1/466166/100/0/threaded
CONFIRMhttp://us2.php.net/releases/4_4_7.php
http://us2.php.net/releases/5_2_2.php
http://www.php.net/ChangeLog-4.php
http://www.php.net/ChangeLog-5.php#5.2.4
http://www.php.net/releases/4_4_8.php
http://www.php.net/releases/5_2_4.php
https://issues.rpath.com/browse/RPL-1268
https://launchpad.net/bugs/173043
GENTOOhttp://security.gentoo.org/glsa/glsa-200705-19.xml
MANDRIVAhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:087
http://www.mandriva.com/security/advisories?name=MDKSA-2007:088
http://www.mandriva.com/security/advisories?name=MDKSA-2007:089
http://www.mandriva.com/security/advisories?name=MDKSA-2007:090
MISChttp://www.php-security.org/MOPB/MOPB-03-2007.html
OSVDBhttp://www.osvdb.org/32769
REDHAThttp://rhn.redhat.com/errata/RHSA-2007-0154.html
http://rhn.redhat.com/errata/RHSA-2007-0155.html
http://rhn.redhat.com/errata/RHSA-2007-0163.html
http://www.redhat.com/support/errata/RHSA-2007-0082.html
http://www.redhat.com/support/errata/RHSA-2007-0162.html
SECTRACKhttp://www.securitytracker.com/id?1017771
SECUNIAhttp://secunia.com/advisories/24909
http://secunia.com/advisories/24910
http://secunia.com/advisories/24924
http://secunia.com/advisories/24941
http://secunia.com/advisories/24945
http://secunia.com/advisories/25445
http://secunia.com/advisories/26048
http://secunia.com/advisories/26642
http://secunia.com/advisories/27864
http://secunia.com/advisories/28936
SLACKWAREhttp://slackware.com/security/viewer.php?l=slackware-security&y=2008&...
SUSEhttp://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
UBUNTUhttp://www.ubuntu.com/usn/usn-549-2
http://www.ubuntulinux.org/support/documentation/usn/usn-549-1

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 10:39:21
  • Multiple Updates
2013-05-11 10:20:16
  • Multiple Updates