PHP 权限许可和访问控制问题漏洞

漏洞信息详情

PHP 权限许可和访问控制问题漏洞

• CNNVD编号：CNNVD-200706-525
• 危害等级： 中危
  
  
• CVE编号：
  CVE-2007-3378
  
• 漏洞类型：
  
  
  权限许可和访问控制问题
  
• 发布时间：
  
  2002-02-03
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2020-09-22
  
• 厂        商：
  
  php
• 漏洞来源：
  Mattias Bengtsson※…

PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHPGroup和开放源代码社区的共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。

PHP 4.4.7及之前版本和5.2.3及之前版本中存在权限许可和访问控制问题漏洞。该漏洞源于网络系统或产品缺乏有效的权限许可和访问控制措施。

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

PHP

—

http://www.php.net/get/php-5.2.4.tar.gz/from/a/mirror

Gentoo

——

Gentoo已经为此发布了一个安全公告(GLSA-200710-02)以及相应补丁:

GLSA-200710-02：PHP: Multiple vulnerabilities

链接：

http://security.gentoo.org/glsa/glsa-200710-02.xml

所有PHP用户都应升级到最新版本：

# emerge –sync

# emerge –ask –oneshot –verbose “>=dev-lang/php-5.2.4_p20070914-r2”

来源:CONFIRM

链接:http://www.php.net/releases/5_2_4.php

来源:TRUSTIX

链接:http://www.trustix.org/errata/2007/0026/

来源:HP

链接:http://www.securityfocus.com/archive/1/491693/100/0/threaded

来源:SECUNIA

链接:http://secunia.com/advisories/27648

来源:SECUNIA

链接:http://secunia.com/advisories/28936

来源:CONFIRM

链接:http://www.php.net/ChangeLog-4.php

来源:CONFIRM

链接:https://issues.rpath.com/browse/RPL-1702

来源:SECUNIA

链接:http://secunia.com/advisories/28318

来源:GENTOO

链接:http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml

来源:FULLDISC

链接:http://seclists.org/fulldisclosure/2020/Sep/34

来源:XF

链接:https://exchange.xforce.ibmcloud.com/vulnerabilities/39403

来源:CONFIRM

链接:http://docs.info.apple.com/article.html?artnum=307562

来源:SECUNIA

链接:http://secunia.com/advisories/26838

来源:SECUNIA

链接:http://secunia.com/advisories/30040

来源:CONFIRM

链接:http://www.php.net/releases/5_2_5.php

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2008/0924/references

来源:XF

链接:https://exchange.xforce.ibmcloud.com/vulnerabilities/35102

来源:SECUNIA

链接:http://secunia.com/advisories/26642

来源:OVAL

链接:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6056

来源:SECUNIA

链接:http://secunia.com/advisories/27377

来源:CONFIRM

链接:http://www.php.net/releases/4_4_8.php

来源:MLIST

链接:http://www.openwall.com/lists/oss-security/2020/09/17/3

来源:SREASON

链接:http://securityreason.com/securityalert/2831

来源:BUGTRAQ

链接:http://www.securityfocus.com/archive/1/472343/100/0/threaded

来源:SLACKWARE

链接:http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136

来源:BID

链接:https://www.securityfocus.com/bid/24661

来源:SECUNIA

链接:http://secunia.com/advisories/26822

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2008/0059

来源:SREASON

链接:http://securityreason.com/securityalert/3389

来源:BID

链接:https://www.securityfocus.com/bid/25498

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2008/0398

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2007/3023

来源:CONFIRM

链接:https://issues.rpath.com/browse/RPL-1693

来源:APPLE

链接:http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

来源:SREASONRES

链接:http://securityreason.com/achievement_securityalert/45

来源:MISC

链接:http://securityreason.com/achievement_exploitalert/9

来源:CONFIRM

链接:http://www.php.net/ChangeLog-5.php#5.2.4

来源:OSVDB

链接:http://www.osvdb.org/38682

来源:CONFIRM

链接:http://www.php.net/ChangeLog-5.php#5.2.5

来源:SECUNIA

链接:http://secunia.com/advisories/27102

来源:SECUNIA

链接:http://secunia.com/advisories/28750

来源:SECUNIA

链接:http://secunia.com/advisories/29420

来源:HP

链接:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501