CVE-2007-1701

PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with _SESSION|s:39:.

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Software

Name	Vendor	Start Version	End Version
Php	Php	4.0.0 (including)	4.4.5 (excluding)
Php	Php	5.0.0 (including)	5.2.1 (excluding)
Red Hat Enterprise Linux 2.1	RedHat	php-0:4.1.2-2.14	*
Red Hat Enterprise Linux 3	RedHat	php-0:4.3.2-39.ent	*
Red Hat Enterprise Linux 4	RedHat	php-0:4.3.9-3.22.3	*
Red Hat Enterprise Linux 5	RedHat	php-0:5.1.6-7.el5	*
Red Hat Web Application Stack for RHEL 4	RedHat	php-0:5.1.6-3.el4s1.5	*
Stronghold 4.0 for RHEL 2.1AS	RedHat	stronghold-php-0:4.1.2-12	*

Potential Mitigations

Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

https://cwe.mitre.org/data/definitions/586.html

NVD	https://nvd.nist.gov/vuln/detail/CVE-2007-1701
CWE	https://cwe.mitre.org/data/definitions/502.html

Deserialization of Untrusted Data

Weakness

Affected Software

Potential Mitigations

References

CVE-2007-1701

Deserialization of Untrusted Data

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References