CVE-2007-3799: Input Validation

Published Jul 16, 2007

Updated

The sessionstart function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATHINFO, (2) the sessionid function, and (3) the sessionstart function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.

Affected Software

69 affected components

PHP PHP=4.3.9

PHP PHP=4.0-beta1

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=4.4.4

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=4.3.6

PHP PHP=4.3.7

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=4.1.1

PHP PHP=4.4.3

PHP PHP=4.2.3

PHP PHP=4.4.5

PHP PHP=4.0-beta2

PHP PHP=4.0.6

PHP PHP=4.1.2

PHP PHP=4.3.1

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=4.4.6

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=4.4.7

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=5.1.1

PHP PHP=5.2.14

PHP PHP=5.0.0-beta1

PHP PHP=5.1.6

PHP PHP=5.2.2

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.0.4

PHP PHP=5.2.12

PHP PHP=5.2.11

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.2.13

PHP PHP=5.0.0-rc3

PHP PHP=5.2.0

PHP PHP=5.0.0-beta3

PHP PHP=5.1.3

PHP PHP=5.2.10

PHP PHP=5.0.0-rc1

PHP PHP=5.0.2

PHP PHP=5.2.1

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=5.0.0-beta2

Event History

Jul 16, 2007

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-3799?

CVE-2007-3799 has a moderate severity rating due to potential session hijacking risks.

How do I fix CVE-2007-3799?

To fix CVE-2007-3799, upgrade PHP to a version equal to or greater than 5.2.4.

What versions of PHP are affected by CVE-2007-3799?

CVE-2007-3799 affects PHP versions 4.x up to 4.4.7 and 5.x up to 5.2.3.

What are the potential impacts of CVE-2007-3799?

The main impact of CVE-2007-3799 is the ability for remote attackers to manipulate session cookies.

Is CVE-2007-3799 a remote code execution vulnerability?

No, CVE-2007-3799 is not classified as a remote code execution vulnerability.