CVE-2005-3389
MEDIUM severity · CVSS 5
5CVSS MEDIUM
Summary
The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impact—
Availability impactNone
Exploit probability (EPSS)6%
AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://secunia.com/advisories/17371 ↗
Additional information
- NVD record
- http://secunia.com/advisories/17371Patch
- http://secunia.com/advisories/17490Advisory
- http://secunia.com/advisories/17510Advisory
- http://secunia.com/advisories/17531Advisory
- http://secunia.com/advisories/17557Advisory
- http://secunia.com/advisories/17559Advisory
- http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
- http://rhn.redhat.com/errata/RHSA-2006-0549.html