FKIE_CVE-2017-7189

Vulnerability from fkie_nvd - Published: 2019-07-10 15:15 - Updated: 2024-11-21 03:31
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
References
cve@mitre.orghttps://bugs.php.net/bug.php?id=74192Permissions Required, Vendor Advisory
cve@mitre.orghttps://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595aPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugs.php.net/bug.php?id=74192Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595aPatch, Third Party Advisory
Impacted products
Vendor Product Version
php php *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D46367B-C8BB-4700-A6B8-79A5DAF5EF33",
              "versionEndExcluding": "7.0.16",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen(\u0027127.0.0.1:80\u0027, 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input."
    },
    {
      "lang": "es",
      "value": "El archivo main/streams/xp_socket.c en PHP versiones 7.x antes del 07-03-2017 analiza inapropiadamente las llamadas fsockopen, como por ejemplo interpretando fsockopen(\u0027127.0.0.1:80\u0027, 443) como si la direcci\u00f3n y el puerto fuera 127.0.0.1:80:443, que luego se trunca a 127.0.0.1:80. Este comportamiento presenta un riesgo de seguridad si el n\u00famero de puerto proporcionado expl\u00edcitamente (es decir, 443 en este ejemplo) est\u00e1 codificado en una aplicaci\u00f3n como una pol\u00edtica de seguridad, pero el argumento hostname (es decir, 127.0.0.1:80 en este ejemplo) es obtenido de una entrada no segura."
    }
  ],
  "id": "CVE-2017-7189",
  "lastModified": "2024-11-21T03:31:20.803",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-07-10T15:15:11.163",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://bugs.php.net/bug.php?id=74192"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://bugs.php.net/bug.php?id=74192"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.