Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2005-3390

Overview

Vulnerability Score 7.5 7.5
CVE Id CVE-2005-3390
Last Modified 07 Mar 2011 09:26:27
Published 01 Nov 2005 07:47:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2005-3390

Summary

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.

Vulnerable Systems

Application

  • Php 3.0

  • Php 3.0.1

  • Php 3.0.10

  • Php 3.0.11

  • Php 3.0.12

  • Php 3.0.13

  • Php 3.0.14

  • Php 3.0.15

  • Php 3.0.16

  • Php 3.0.17

  • Php 3.0.18

  • Php 3.0.2

  • Php 3.0.3

  • Php 3.0.4

  • Php 3.0.5

  • Php 3.0.6

  • Php 3.0.7

  • Php 3.0.8

  • Php 3.0.9

  • Php 4.0.0

  • Php 4.0.1

  • Php 4.0.2

  • Php 4.0.3

  • Php 4.0.4

  • Php 4.0.5

  • Php 4.0.6

  • Php 4.0.7

  • Php 4.1.0

  • Php 4.1.1

  • Php 4.1.2

  • Php 4.2

  • Php 4.2.0

  • Php 4.2.1

  • Php 4.2.2

  • Php 4.2.3

  • Php 4.3

  • Php 4.3.1

  • Php 4.3.10

  • Php 4.3.11

  • Php 4.3.2

  • Php 4.3.3

  • Php 4.3.4

  • Php 4.3.5

  • Php 4.3.6

  • Php 4.3.7

  • Php 4.3.8

  • Php 4.3.9

  • Php 4.4.0

  • Php 5.0

  • Php 5.0.0

  • Php 5.0.1

  • Php 5.0.2

  • Php 5.0.3

  • Php 5.0.4

  • Php 5.0.5


References

BID - 15250

CONFIRM - http://www.php.net/release_4_4_1.php

SECUNIA - 17371

VUPEN - ADV-2006-4320

VUPEN - ADV-2005-2254

BUGTRAQ - 20051031 Advisory 20/2005: PHP File-Upload $GLOBALS Overwrite Vulnerability

MISC - http://www.hardened-php.net/globals-problem

MISC - http://www.hardened-php.net/advisory_202005.79.html

HP - HPSBMA02159

UBUNTU - USN-232-1

SUSE - SUSE-SA:2005:069

REDHAT - RHSA-2005:838

REDHAT - RHSA-2005:831

OPENPKG - OpenPKG-SA-2005.027

SUSE - SUSE-SR:2005:027

MANDRIVA - MDKSA-2005:213

GENTOO - GLSA-200511-08

FEDORA - FLSA:166943

CONFIRM - http://support.avaya.com/elmodocs2/security/ASA-2006-037.htm

SECTRACK - 1015129

SREASON - 132

SECUNIA - 22691

SECUNIA - 21252

SECUNIA - 18669

SECUNIA - 18198

SECUNIA - 18054

SECUNIA - 17559

SECUNIA - 17557

SECUNIA - 17531

SECUNIA - 17510

SECUNIA - 17490

REDHAT - RHSA-2006:0549

HP - SSRT061238


Last Updated: 27 May 2016 10:40:55