PT-2006-3580 · Php · Php

Maksymilian Arciemowicz · Publicado 2006-06-13 · Atualizado 2018-10-30 · CVE-2006-2660

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 4.x through 4.4.2 PHP version 5.1.4

Description A buffer consumption issue in the tempnam function allows local users to bypass restrictions and create PHP files with fixed names in other directories. This is achieved by providing a pathname argument longer than MAXPATHLEN, preventing a unique string from being appended to the filename.

Recommendations For PHP versions 4.x through 4.4.2, update to version 4.4.3 or later to resolve the issue. For PHP version 5.1.4, update to a newer version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the tempnam function until a patch is available.

Correção

Identificadores relacionados

CVE-2006-2660

Produtos afetados

Php

Referências · 14

• http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:122 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0209.html · Nota
• http://securityreason.com/securityalert/1069 · Nota
• http://xforce.iss.net/xforce/xfdb/27049 · Nota
• http://securityfocus.com/archive/1/436785/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27049 · Nota
• http://securitytracker.com/id?1016271 · Nota
• http://secunia.com/advisories/21125 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2006:122 · Aviso do Fabricante
• http://securityfocus.com/archive/1/archive/1/436785/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2660 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2660 · Nota de Segurança
• http://ubuntu.com/usn/usn-320-1 · Aviso do Fabricante
• http://cvs.php.net/viewcvs.cgi/php-src/NEWS?view=markup&rev=1.1247.2.920.2.134 · Nota