National Cyber-Alert System

Vulnerability Summary for CVE-2007-4887

Overview

The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter. NOTE: there are limited usage scenarios under which this would be a vulnerability.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Mandriva (09/18/2007)

Because the argument passed to the dl() function are always under the control of the author, Mandriva does not consider this a security issue.

Official Statement from Red Hat (09/14/2007)

The argument passed to the dl() function must always be under the control of the script author. We therefore do not consider this to be a security issue.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BUGTRAQ

Name: 20070910 /* PHP <=5.2.4 open_basedir bypass & code exec & denial of service errata ... working on windows too .. */

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/478988/100/0/threaded

External Source: BUGTRAQ

Name: 20070910 PHP <=5.2.4 open_basedir bypass & code exec & denial of service

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/478985/100/0/threaded

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242

External Source: OVAL

Name: oval:org.mitre.oval:def:5767

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5767

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1943

Hyperlink:https://issues.rpath.com/browse/RPL-1943

External Source: BID

Name: 26403

Hyperlink:http://www.securityfocus.com/bid/26403

External Source: HP

Name: HPSBUX02332

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/491693/100/0/threaded

External Source: CONFIRM

Name: http://www.php.net/releases/5_2_5.php

Hyperlink:http://www.php.net/releases/5_2_5.php

External Source: CONFIRM

Name: http://www.php.net/ChangeLog-5.php#5.2.5

Hyperlink:http://www.php.net/ChangeLog-5.php#5.2.5

External Source: GENTOO

Name: GLSA-200710-02

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml

External Source: VUPEN

Name: ADV-2008-0924

Hyperlink:http://www.frsirt.com/english/advisories/2008/0924/references

External Source: VUPEN

Name: ADV-2008-0398

Hyperlink:http://www.frsirt.com/english/advisories/2008/0398

External Source: VUPEN

Name: ADV-2007-3825

Hyperlink:http://www.frsirt.com/english/advisories/2007/3825

External Source: SREASON

Name: 3133

Hyperlink:http://securityreason.com/securityalert/3133

External Source: SECUNIA

Name: 30040

Hyperlink:http://secunia.com/advisories/30040

External Source: SECUNIA

Name: 29420

Hyperlink:http://secunia.com/advisories/29420

External Source: SECUNIA

Name: 28750

Hyperlink:http://secunia.com/advisories/28750

External Source: SECUNIA

Name: 27659

Hyperlink:http://secunia.com/advisories/27659

External Source: SECUNIA

Name: 27102

Hyperlink:http://secunia.com/advisories/27102

External Source: APPLE

Name: APPLE-SA-2008-03-18

Hyperlink:http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

External Source: HP

Name: SSRT080010

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=307562

Hyperlink:http://docs.info.apple.com/article.html?artnum=307562