National Vulnerability Database (NVD) National Vulnerability Database (CVE-2007-1001)

National Cyber-Alert System

Vulnerability Summary for CVE-2007-1001

Original release date:04/06/2007

Last revised:09/05/2008

Source: US-CERT/NIST

Overview

Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:6.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type:Provides unauthorized access, Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statments (disclaimer)

Official Statement from Red Hat (02/14/2008): This issue was fixed in php package updates for Red Hat Enterprise Linux and Red Hat Application Stack: http://rhn.redhat.com/cve/CVE-2007-1001.html This issue did not affect the versions of gd as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2007-1269

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2007/1269

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1268

Hyperlink:https://issues.rpath.com/browse/RPL-1268

External Source: XF

Name: php-gd-overflow(33453)

Hyperlink:http://xforce.iss.net/xforce/xfdb/33453

External Source: BID

Name: 23357

Hyperlink:http://www.securityfocus.com/bid/23357

External Source: BUGTRAQ

Name: 20070418 rPSA-2007-0073-1 php php-mysql php-pgsql

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/466166/100/0/threaded

External Source: BUGTRAQ

Name: 20070407 PHP <= 5.2.1 wbmp file handling integer overflow

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/464957/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:0162

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0162.html

External Source: REDHAT

Name: RHSA-2007:0153

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0153.html

External Source: SECUNIA

Name: 24965

Hyperlink:http://secunia.com/advisories/24965

External Source: SECUNIA

Name: 24945

Hyperlink:http://secunia.com/advisories/24945

External Source: SECUNIA

Name: 24924

Hyperlink:http://secunia.com/advisories/24924

External Source: SECUNIA

Name: 24814

Hyperlink:http://secunia.com/advisories/24814

External Source: REDHAT

Name: RHSA-2007:0155

Hyperlink:http://rhn.redhat.com/errata/RHSA-2007-0155.html

External Source: MISC

Name: http://ifsec.blogspot.com/2007/04/php-521-wbmp-file-handling-integer.html

Hyperlink:http://ifsec.blogspot.com/2007/04/php-521-wbmp-file-handling-integer.html

External Source: CONFIRM

Name: http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?revision=1.2.4.1.8.1&view=markup

Hyperlink:http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?revision=1.2.4.1.8.1&view=markup

External Source: MISC

Name: http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?r1=1.2.4.1&r2=1.2.4.1.8.1

Hyperlink:http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?r1=1.2.4.1&r2=1.2.4.1.8.1

External Source: SLACKWARE

Name: SSA:2007-127

Hyperlink:http://www.slackware.org/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.470053

External Source: BID

Name: 25159

Hyperlink:http://www.securityfocus.com/bid/25159

External Source: SUSE

Name: SUSE-SA:2007:032

Hyperlink:http://www.novell.com/linux/security/advisories/2007_32_php.html

External Source: MANDRIVA

Name: MDKSA-2007:090

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:090

External Source: MANDRIVA

Name: MDKSA-2007:089

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:089

External Source: MANDRIVA

Name: MDKSA-2007:088

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:088

External Source: MANDRIVA

Name: MDKSA-2007:087

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:087

External Source: VUPEN

Name: ADV-2007-2732

Hyperlink:http://www.frsirt.com/english/advisories/2007/2732

External Source: CONFIRM

Name: http://us2.php.net/releases/5_2_2.php

Hyperlink:http://us2.php.net/releases/5_2_2.php

External Source: CONFIRM

Name: http://us2.php.net/releases/4_4_7.php

Hyperlink:http://us2.php.net/releases/4_4_7.php

External Source: GENTOO

Name: GLSA-200705-19

Hyperlink:http://security.gentoo.org/glsa/glsa-200705-19.xml

External Source: SECUNIA

Name: 26235

Hyperlink:http://secunia.com/advisories/26235

External Source: SECUNIA

Name: 25445

Hyperlink:http://secunia.com/advisories/25445

External Source: SECUNIA

Name: 25151

Hyperlink:http://secunia.com/advisories/25151

External Source: SECUNIA

Name: 25056

Hyperlink:http://secunia.com/advisories/25056

External Source: SECUNIA

Name: 24909

Hyperlink:http://secunia.com/advisories/24909

External Source: APPLE

Name: APPLE-SA-2007-07-31

Hyperlink:http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html

External Source: MANDRIVA

Name: MDKSA-2007:089

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:089

External Source: MANDRIVA

Name: MDKSA-2007:088

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:088

External Source: MANDRIVA

Name: MDKSA-2007:087

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:087

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=306172

Hyperlink:http://docs.info.apple.com/article.html?artnum=306172

Vulnerable software and versions

Configuration 1

* cpe:/a:php:php:4.0

* cpe:/a:php:php:4.0.0

* cpe:/a:php:php:4.0.1

* cpe:/a:php:php:4.0.1:patch1

* cpe:/a:php:php:4.0.1:patch2

* cpe:/a:php:php:4.0.2

* cpe:/a:php:php:4.0.3

* cpe:/a:php:php:4.0.3:patch1

* cpe:/a:php:php:4.0.4

* cpe:/a:php:php:4.0.4:patch1

* cpe:/a:php:php:4.0.5

* cpe:/a:php:php:4.0.6

* cpe:/a:php:php:4.0.7

* cpe:/a:php:php:4.0.7:rc1

* cpe:/a:php:php:4.0.7:rc2

* cpe:/a:php:php:4.0.7:rc3

* cpe:/a:php:php:4.0:beta_4_patch1

* cpe:/a:php:php:4.0:beta1

* cpe:/a:php:php:4.0:beta2

* cpe:/a:php:php:4.0:beta3

* cpe:/a:php:php:4.0:beta4

* cpe:/a:php:php:4.0:rc1

* cpe:/a:php:php:4.0:rc2

* cpe:/a:php:php:4.1.0

* cpe:/a:php:php:4.1.1

* cpe:/a:php:php:4.1.2

* cpe:/a:php:php:4.2.0

* cpe:/a:php:php:4.2.1

* cpe:/a:php:php:4.2.2

* cpe:/a:php:php:4.2.3

* cpe:/a:php:php:4.2::dev

* cpe:/a:php:php:4.3

* cpe:/a:php:php:4.3.1

* cpe:/a:php:php:4.3.10

* cpe:/a:php:php:4.3.11

* cpe:/a:php:php:4.3.2

* cpe:/a:php:php:4.3.3

* cpe:/a:php:php:4.3.4

* cpe:/a:php:php:4.3.5

* cpe:/a:php:php:4.3.6

* cpe:/a:php:php:4.3.7

* cpe:/a:php:php:4.3.8

* cpe:/a:php:php:4.3.9

* cpe:/a:php:php:4.4.0

* cpe:/a:php:php:4.4.1

* cpe:/a:php:php:4.4.2

* cpe:/a:php:php:4.4.3

* cpe:/a:php:php:4.4.4

* cpe:/a:php:php:4.4.5

* cpe:/a:php:php:4.4.6

* cpe:/a:php:php:5.0.0

* cpe:/a:php:php:5.0.0:beta1

* cpe:/a:php:php:5.0.0:beta2

* cpe:/a:php:php:5.0.0:beta3

* cpe:/a:php:php:5.0.0:beta4

* cpe:/a:php:php:5.0.0:rc1

* cpe:/a:php:php:5.0.0:rc2

* cpe:/a:php:php:5.0.0:rc3

* cpe:/a:php:php:5.0.1

* cpe:/a:php:php:5.0.2

* cpe:/a:php:php:5.0.3

* cpe:/a:php:php:5.0.4

* cpe:/a:php:php:5.0.5

* cpe:/a:php:php:5.0:rc1

* cpe:/a:php:php:5.0:rc2

* cpe:/a:php:php:5.0:rc3

* cpe:/a:php:php:5.1

* cpe:/a:php:php:5.1.0

* cpe:/a:php:php:5.1.1

* cpe:/a:php:php:5.1.2

* cpe:/a:php:php:5.1.3

* cpe:/a:php:php:5.1.4

* cpe:/a:php:php:5.1.5

* cpe:/a:php:php:5.1.6

* cpe:/a:php:php:5.2.0

* cpe:/a:php:php:5.2.1

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1001