MEDIUM
security flaw
Published Nov 1, 2005
5.0
MEDIUMCVSS 2.0
EPSS 6.30%
Description
The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected.
Affected products
No data.
OR
- 4.0.0
- 4.0.1
- 4.0.1
- 4.0.1
- 4.0.2
- 4.0.3
- 4.0.3
- 4.0.4
- 4.0.5
- 4.0.6
- 4.0.7
- 4.0.7
- 4.0.7
- 4.0.7
- 4.1.0
- 4.1.1
- 4.1.2
- 4.2
- 4.2.0
- 4.2.1
- 4.2.2
- 4.2.3
- 4.3.0
- 4.3.1
- 4.3.2
- 4.3.3
- 4.3.4
- 4.3.5
- 4.3.6
- 4.3.7
- 4.3.8
- 4.3.9
- 4.3.10
- 4.3.11
- 4.4.0
- 5.0.0
- 5.0.0
- 5.0.0
- 5.0.0
- 5.0.0
- 5.0.0
- 5.0.0
- 5.0.0
- 5.0.1
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
No data.
Red Hat Enterprise Linux 3
php-0:4.3.2-26.ent
Fixed · RHSA-2005:831
Red Hat Enterprise Linux 4
php-0:4.3.9-3.9
Fixed · RHSA-2005:831
Red Hat Enterprise Linux AS (Advanced Server) version 2.1
n/a
Fixed · RHSA-2005:838
Red Hat Enterprise Linux ES version 2.1
n/a
Fixed · RHSA-2005:838
Red Hat Enterprise Linux WS version 2.1
n/a
Fixed · RHSA-2005:838
Red Hat Linux Advanced Workstation 2.1
n/a
Fixed · RHSA-2005:838
Red Hat Stronghold 4
n/a
Fixed · RHSA-2005:882
Stronghold 4.0 for Red Hat Enterprise Linux AS (version 2.1)
n/a
Fixed · RHSA-2006:0549
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 3 | php-0:4.3.2-26.ent | Fixed | RHSA-2005:831 |
| Red Hat Enterprise Linux 4 | php-0:4.3.9-3.9 | Fixed | RHSA-2005:831 |
| Red Hat Enterprise Linux AS (Advanced Server) version 2.1 | n/a | Fixed | RHSA-2005:838 |
| Red Hat Enterprise Linux ES version 2.1 | n/a | Fixed | RHSA-2005:838 |
| Red Hat Enterprise Linux WS version 2.1 | n/a | Fixed | RHSA-2005:838 |
| Red Hat Linux Advanced Workstation 2.1 | n/a | Fixed | RHSA-2005:838 |
| Red Hat Stronghold 4 | n/a | Fixed | RHSA-2005:882 |
| Stronghold 4.0 for Red Hat Enterprise Linux AS (version 2.1) | n/a | Fixed | RHSA-2006:0549 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (0)
No CWE recorded.
References (38)
- http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522 vendor-advisoryx_refsource_HP
- http://rhn.redhat.com/errata/RHSA-2006-0549.html vendor-advisoryx_refsource_REDHAT
- http://secunia.com/advisories/17371 third-party-advisoryx_refsource_SECUNIAPatchVendor Advisory
- http://secunia.com/advisories/17490 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17510 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17531 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17557 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17559 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18054 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18198 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18669 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/21252 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/22691 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://securityreason.com/securityalert/134 third-party-advisoryx_refsource_SREASON
- http://securitytracker.com/id?1015131 vdb-entryx_refsource_SECTRACK
- http://support.avaya.com/elmodocs2/security/ASA-2006-037.htm x_refsource_CONFIRM
- http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html vendor-advisoryx_refsource_FEDORA
- http://www.gentoo.org/security/en/glsa/glsa-200511-08.xml vendor-advisoryx_refsource_GENTOO
- http://www.hardened-php.net/advisory_192005.78.html x_refsource_MISCVendor Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:213 vendor-advisoryx_refsource_MANDRIVA
- http://www.novell.com/linux/security/advisories/2005_27_sr.html vendor-advisoryx_refsource_SUSE
- http://www.openpkg.org/security/OpenPKG-SA-2005.027-php.html vendor-advisoryx_refsource_OPENPKG
- http://www.php.net/release_4_4_1.php x_refsource_CONFIRMPatch
- http://www.redhat.com/support/errata/RHSA-2005-831.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2005-838.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/415291 mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/419504/100/0/threaded vendor-advisoryx_refsource_SUSE
- http://www.securityfocus.com/bid/15249 vdb-entryx_refsource_BIDPatch
- http://www.turbolinux.com/security/2006/TLSA-2006-38.txt vendor-advisoryx_refsource_TURBO
- http://www.vupen.com/english/advisories/2005/2254 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2006/4320 vdb-entryx_refsource_VUPENVendor Advisory
- https://access.redhat.com/security/cve/CVE-2005-3389 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1617822 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2005-3388 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2005-3389
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11481 vdb-entrysignaturex_refsource_OVAL
- https://www.cve.org/CVERecord?id=CVE-2005-3389
- https://www.ubuntu.com/usn/usn-232-1/ vendor-advisoryx_refsource_UBUNTU
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Nov 1, 2005
Updated Aug 7, 2024
Reserved Nov 1, 2005
Link CVE-2005-3389
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2005-3388 Assigner mitre
Published Nov 1, 2005
Updated Aug 7, 2024
Exploited since n/a
Link EUVD-2005-3388