PT-2006-3916 · Php · Php

Cxib8O3 + 1 · Published 2006-06-26 · Updated 2017-07-20 · CVE-2006-3011

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 4.4.2 through 4.4.3 PHP versions 5.1.4 and earlier

Description The issue allows local users to bypass safe mode and open basedir restrictions. This is due to an input validation error in the error log() function, specifically in the processing of the destination parameter. The vulnerability can be exploited via directory traversal attacks using the "php://" wrapper.

Recommendations For PHP versions 4.4.2 through 4.4.3, update to version 4.4.4 or later. For PHP versions 5.1.4 and earlier, update to version 5.1.5 or later. As a temporary workaround, consider restricting the use of the error log() function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-3011

Affected Products

Php

References · 21

• 🔥 https://exploit-db.com/exploits/7171 · Exploit
• 🔥 http://securityreason.com/achievement_securityalert/41 · Exploit
• http://vupen.com/english/advisories/2006/2523 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:122 · Vendor Advisory
• http://secunia.com/advisories/21546 · Vendor Advisory
• http://secunia.com/advisories/20818 · Vendor Advisory
• http://secunia.com/advisories/21050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3011 · Security Note
• http://ubuntu.com/usn/usn-320-1 · Vendor Advisory
• http://secunia.com/advisories/21125 · Vendor Advisory
• http://nvd.nist.gov/cvss.cfm?vector=(AV:L/AC:L/Au:NR/C:P/I:P/A:P/B:I) · Note
• http://securityfocus.com/bid/18645 · Note
• http://cvs.php.net/viewvc.cgi/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.9&r2=1.543.2.51.2.10&pathrev=PHP_4_4&diff_format=u · Note
• http://cvs.php.net/viewvc.cgi/php-src/ext/standard/basic_functions.c?diff_format=u&view=log&pathrev=PHP_4_4 · Note
• http://osvdb.org/26827 · Note