PT-2006-5283 · Php · Php

Publicado 2006-08-31 · Atualizado 2022-07-19 · CVE-2006-4483

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.1.5

Description The issue in PHP allows attackers to perform unauthorized actions when the CURLOPT FOLLOWLOCATION option is permitted, possibly related to the realpath cache, even when open basedir or safe mode is enabled.

Recommendations For versions prior to 5.1.5, update to version 5.1.5 or later to resolve the issue. As a temporary workaround, consider disabling the CURLOPT FOLLOWLOCATION option when open basedir or safe mode is enabled.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2006-4483

Produtos afetados

Php

Referências · 17

• http://php.net/release_5_1_5.php · Aviso do Fabricante
• http://secunia.com/advisories/22039 · Nota
• http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-4483 · Nota de Segurança
• http://secunia.com/advisories/21546 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4483 · Nota
• http://vupen.com/english/advisories/2006/3318 · Nota
• http://frsirt.com/english/advisories/2006/3318 · Nota
• http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 · Correção
• http://securityfocus.com/archive/1/492671/100/0/threaded · Nota
• http://securityfocus.com/bid/19582 · Nota
• http://secunia.com/advisories/30411 · Nota
• http://php.net/ChangeLog-5.php#5.1.5 · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2006_52_php.html · Aviso do Fabricante
• http://securitytracker.com/id?1016984 · Nota