Bug 240431 (CVE-2007-1701)

Summary:	CVE-2007-1701 php session extension global variable clobber
Product:	[Other] Security Response	Reporter:	Joe Orton <jorton>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	paul.boin
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-05-21 10:15:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Joe Orton 2007-05-17 14:48:37 UTC

Description of problem:
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled,
allows context-dependent attackers to execute arbitrary code via deserialization
of session data, which overwrites arbitrary global variables, as demonstrated by
calling session_decode on a string beginning with "_SESSION|s:39:".

Comment 1 Joe Orton 2007-05-17 14:49:54 UTC

This issue was fixed under the name CVE-2007-0910 in errata published by Red
Hat;  at time of writing the advisories have not been updated to reference the
new CVE name.

http://rhn.redhat.com/errata/CVE-2007-0910.html

Comment 2 Joe Orton 2007-05-17 14:51:29 UTC

*** Bug 239322 has been marked as a duplicate of this bug. ***

Comment 3 Joe Orton 2007-05-21 10:12:19 UTC

Advisory references have now been updated:

http://rhn.redhat.com/errata/CVE-2007-1701.html