NVD

Id
55530  
Name
CVE-2007-3378  
Description
The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-06-29  
Modified Date
2011-03-07  
Seq
2007-3378  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
282173 55530 CVE-2007-3378 http://docs.info.apple.com/article.html?artnum=307562  View
282174 55530 CVE-2007-3378 SSRT080010  View
282175 55530 CVE-2007-3378 APPLE-SA-2008-03-18  View
282176 55530 CVE-2007-3378 oval:org.mitre.oval:def:6056  View
282177 55530 CVE-2007-3378 http://securityreason.com/achievement_exploitalert/9  View
282178 55530 CVE-2007-3378 20070627 PHP 5.2.3 PHP 4.4.7, htaccess safemode and open_basedir Bypass  View
282179 55530 CVE-2007-3378 2831  View
282180 55530 CVE-2007-3378 3389  View
282181 55530 CVE-2007-3378 SSA:2008-045-03  View
282182 55530 CVE-2007-3378 GLSA-200710-02  View
282183 55530 CVE-2007-3378 http://www.php.net/ChangeLog-4.php  View
282184 55530 CVE-2007-3378 http://www.php.net/ChangeLog-5.php#5.2.4  View
282185 55530 CVE-2007-3378 http://www.php.net/ChangeLog-5.php#5.2.5  View
282186 55530 CVE-2007-3378 http://www.php.net/releases/4_4_8.php  View
282187 55530 CVE-2007-3378 http://www.php.net/releases/5_2_4.php  View
282188 55530 CVE-2007-3378 http://www.php.net/releases/5_2_5.php  View
282189 55530 CVE-2007-3378 20070627 PHP 4/5 htaccess safemode and open_basedir Bypass  View
282190 55530 CVE-2007-3378 SSRT080056  View
282191 55530 CVE-2007-3378 24661  View
282192 55530 CVE-2007-3378 25498  View
282193 55530 CVE-2007-3378 2007-0026  View
282194 55530 CVE-2007-3378 ADV-2007-3023  View
282195 55530 CVE-2007-3378 ADV-2008-0059  View
282196 55530 CVE-2007-3378 ADV-2008-0398  View
282197 55530 CVE-2007-3378 ADV-2008-0924  View
282198 55530 CVE-2007-3378 php-htaccess-security-bypass(35102)  View
282199 55530 CVE-2007-3378 php-sessionsavepath-errorlog-security-bypass(39403)  View
282200 55530 CVE-2007-3378 https://issues.rpath.com/browse/RPL-1693  View
282201 55530 CVE-2007-3378 https://issues.rpath.com/browse/RPL-1702  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51985 JVNDB-2007-000648 PHP の複数の関数における任意のコマンドを実行される脆弱性 PHP の session_save_path() 関数および ini_set() 関数、error_log() 関数には、safe_mode および open_basedir の制限を回避可能となり、.htaccess 上の php_value ディレクティブを通して任意のコマンドを実行される脆弱性が存在します。 CVE-2007-3378 26733 CVE-2007-3378 55530 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000648.html 2007-06-29 2008-05-21 View