NVD Vulnerability Detail

CVE-2005-3390

Summary	The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.
Publication Date	Nov. 1, 2005, 9:47 p.m.
Registration Date	Jan. 29, 2021, 5:59 p.m.
Last Update	Oct. 31, 2018, 1:25 a.m.

CVSS2.0 : HIGH
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:php:php:3.0:::::::*
cpe:2.3:a:php:php:3.0.1:::::::*
cpe:2.3:a:php:php:3.0.2:::::::*
cpe:2.3:a:php:php:3.0.3:::::::*
cpe:2.3:a:php:php:3.0.4:::::::*
cpe:2.3:a:php:php:3.0.5:::::::*
cpe:2.3:a:php:php:3.0.6:::::::*
cpe:2.3:a:php:php:3.0.7:::::::*
cpe:2.3:a:php:php:3.0.8:::::::*
cpe:2.3:a:php:php:3.0.9:::::::*
cpe:2.3:a:php:php:3.0.10:::::::*
cpe:2.3:a:php:php:3.0.11:::::::*
cpe:2.3:a:php:php:3.0.12:::::::*
cpe:2.3:a:php:php:3.0.13:::::::*
cpe:2.3:a:php:php:3.0.14:::::::*
cpe:2.3:a:php:php:3.0.15:::::::*
cpe:2.3:a:php:php:3.0.16:::::::*
cpe:2.3:a:php:php:3.0.17:::::::*
cpe:2.3:a:php:php:3.0.18:::::::*
cpe:2.3:a:php:php:4.0.0:::::::*
cpe:2.3:a:php:php:4.0.1:::::::*
cpe:2.3:a:php:php:4.0.1:patch1::::::
cpe:2.3:a:php:php:4.0.1:patch2::::::
cpe:2.3:a:php:php:4.0.2:::::::*
cpe:2.3:a:php:php:4.0.3:::::::*
cpe:2.3:a:php:php:4.0.3:patch1::::::
cpe:2.3:a:php:php:4.0.4:::::::*
cpe:2.3:a:php:php:4.0.5:::::::*
cpe:2.3:a:php:php:4.0.6:::::::*
cpe:2.3:a:php:php:4.0.7:::::::*
cpe:2.3:a:php:php:4.0.7:rc1::::::
cpe:2.3:a:php:php:4.0.7:rc2::::::
cpe:2.3:a:php:php:4.0.7:rc3::::::
cpe:2.3:a:php:php:4.1.0:::::::*
cpe:2.3:a:php:php:4.1.1:::::::*
cpe:2.3:a:php:php:4.1.2:::::::*
cpe:2.3:a:php:php:4.2::dev:::::
cpe:2.3:a:php:php:4.2.0:::::::*
cpe:2.3:a:php:php:4.2.1:::::::*
cpe:2.3:a:php:php:4.2.2:::::::*
cpe:2.3:a:php:php:4.2.3:::::::*
cpe:2.3:a:php:php:4.3.0:::::::*
cpe:2.3:a:php:php:4.3.1:::::::*
cpe:2.3:a:php:php:4.3.2:::::::*
cpe:2.3:a:php:php:4.3.3:::::::*
cpe:2.3:a:php:php:4.3.4:::::::*
cpe:2.3:a:php:php:4.3.5:::::::*
cpe:2.3:a:php:php:4.3.6:::::::*
cpe:2.3:a:php:php:4.3.7:::::::*
cpe:2.3:a:php:php:4.3.8:::::::*
cpe:2.3:a:php:php:4.3.9:::::::*
cpe:2.3:a:php:php:4.3.10:::::::*
cpe:2.3:a:php:php:4.3.11:::::::*
cpe:2.3:a:php:php:4.4.0:::::::*
cpe:2.3:a:php:php:5.0:rc1::::::
cpe:2.3:a:php:php:5.0:rc2::::::
cpe:2.3:a:php:php:5.0:rc3::::::
cpe:2.3:a:php:php:5.0.0:::::::*
cpe:2.3:a:php:php:5.0.1:::::::*
cpe:2.3:a:php:php:5.0.2:::::::*
cpe:2.3:a:php:php:5.0.3:::::::*
cpe:2.3:a:php:php:5.0.4:::::::*
cpe:2.3:a:php:php:5.0.5:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522	HP
2	http://rhn.redhat.com/errata/RHSA-2006-0549.html	REDHAT
3	http://secunia.com/advisories/17371	SECUNIA	Patch Vendor Advisory
4	http://secunia.com/advisories/17490	SECUNIA
5	http://secunia.com/advisories/17510	SECUNIA
6	http://secunia.com/advisories/17531	SECUNIA
7	http://secunia.com/advisories/17557	SECUNIA
8	http://secunia.com/advisories/17559	SECUNIA
9	http://secunia.com/advisories/18054	SECUNIA
10	http://secunia.com/advisories/18198	SECUNIA
11	http://secunia.com/advisories/18669	SECUNIA
12	http://secunia.com/advisories/21252	SECUNIA
13	http://secunia.com/advisories/22691	SECUNIA
14	http://securityreason.com/securityalert/132	SREASON
15	http://securitytracker.com/id?1015129	SECTRACK
16	http://support.avaya.com/elmodocs2/security/ASA-2006-037.htm	CONFIRM
17	http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html	FEDORA
18	http://www.gentoo.org/security/en/glsa/glsa-200511-08.xml	GENTOO
19	http://www.hardened-php.net/advisory_202005.79.html	MISC	Vendor Advisory
20	http://www.hardened-php.net/globals-problem	MISC
21	http://www.mandriva.com/security/advisories?name=MDKSA-2005:213	MANDRIVA
22	http://www.novell.com/linux/security/advisories/2005_27_sr.html	SUSE
23	http://www.openpkg.org/security/OpenPKG-SA-2005.027-php.html	OPENPKG
24	http://www.php.net/release_4_4_1.php	CONFIRM	Patch
25	http://www.redhat.com/support/errata/RHSA-2005-831.html	REDHAT
26	http://www.redhat.com/support/errata/RHSA-2005-838.html	REDHAT
27	http://www.securityfocus.com/archive/1/415290/30/0/threaded	BUGTRAQ
28	http://www.securityfocus.com/archive/1/419504/100/0/threaded	SUSE
29	http://www.securityfocus.com/bid/15250	BID	Patch
30	http://www.vupen.com/english/advisories/2005/2254	VUPEN
31	http://www.vupen.com/english/advisories/2006/4320	VUPEN
32	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10537	OVAL
33	https://www.ubuntu.com/usn/usn-232-1/	UBUNTU

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:php:php:3.0:::::::*
cpe:2.3:a:php:php:3.0.1:::::::*
cpe:2.3:a:php:php:3.0.2:::::::*
cpe:2.3:a:php:php:3.0.3:::::::*
cpe:2.3:a:php:php:3.0.4:::::::*
cpe:2.3:a:php:php:3.0.5:::::::*
cpe:2.3:a:php:php:3.0.6:::::::*
cpe:2.3:a:php:php:3.0.7:::::::*
cpe:2.3:a:php:php:3.0.8:::::::*
cpe:2.3:a:php:php:3.0.9:::::::*
cpe:2.3:a:php:php:3.0.10:::::::*
cpe:2.3:a:php:php:3.0.11:::::::*
cpe:2.3:a:php:php:3.0.12:::::::*
cpe:2.3:a:php:php:3.0.13:::::::*
cpe:2.3:a:php:php:3.0.14:::::::*
cpe:2.3:a:php:php:3.0.15:::::::*
cpe:2.3:a:php:php:3.0.16:::::::*
cpe:2.3:a:php:php:3.0.17:::::::*
cpe:2.3:a:php:php:3.0.18:::::::*
cpe:2.3:a:php:php:4.0.0:::::::*
cpe:2.3:a:php:php:4.0.1:::::::*
cpe:2.3:a:php:php:4.0.1:patch1::::::
cpe:2.3:a:php:php:4.0.1:patch2::::::
cpe:2.3:a:php:php:4.0.2:::::::*
cpe:2.3:a:php:php:4.0.3:::::::*
cpe:2.3:a:php:php:4.0.3:patch1::::::
cpe:2.3:a:php:php:4.0.4:::::::*
cpe:2.3:a:php:php:4.0.5:::::::*
cpe:2.3:a:php:php:4.0.6:::::::*
cpe:2.3:a:php:php:4.0.7:::::::*
cpe:2.3:a:php:php:4.0.7:rc1::::::
cpe:2.3:a:php:php:4.0.7:rc2::::::
cpe:2.3:a:php:php:4.0.7:rc3::::::
cpe:2.3:a:php:php:4.1.0:::::::*
cpe:2.3:a:php:php:4.1.1:::::::*
cpe:2.3:a:php:php:4.1.2:::::::*
cpe:2.3:a:php:php:4.2::dev:::::
cpe:2.3:a:php:php:4.2.0:::::::*
cpe:2.3:a:php:php:4.2.1:::::::*
cpe:2.3:a:php:php:4.2.2:::::::*
cpe:2.3:a:php:php:4.2.3:::::::*
cpe:2.3:a:php:php:4.3.0:::::::*
cpe:2.3:a:php:php:4.3.1:::::::*
cpe:2.3:a:php:php:4.3.2:::::::*
cpe:2.3:a:php:php:4.3.3:::::::*
cpe:2.3:a:php:php:4.3.4:::::::*
cpe:2.3:a:php:php:4.3.5:::::::*
cpe:2.3:a:php:php:4.3.6:::::::*
cpe:2.3:a:php:php:4.3.7:::::::*
cpe:2.3:a:php:php:4.3.8:::::::*
cpe:2.3:a:php:php:4.3.9:::::::*
cpe:2.3:a:php:php:4.3.10:::::::*
cpe:2.3:a:php:php:4.3.11:::::::*
cpe:2.3:a:php:php:4.4.0:::::::*
cpe:2.3:a:php:php:5.0:rc1::::::
cpe:2.3:a:php:php:5.0:rc2::::::
cpe:2.3:a:php:php:5.0:rc3::::::
cpe:2.3:a:php:php:5.0.0:::::::*
cpe:2.3:a:php:php:5.0.1:::::::*
cpe:2.3:a:php:php:5.0.2:::::::*
cpe:2.3:a:php:php:5.0.3:::::::*
cpe:2.3:a:php:php:5.0.4:::::::*
cpe:2.3:a:php:php:5.0.5:::::::*