PT-2006-5283 · Php · Php

Published 2006-08-31 · Updated 2022-07-19 · CVE-2006-4483

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.1.5

Description The issue in PHP allows attackers to perform unauthorized actions when the CURLOPT FOLLOWLOCATION option is permitted, possibly related to the realpath cache, even when open basedir or safe mode is enabled.

Recommendations For versions prior to 5.1.5, update to version 5.1.5 or later to resolve the issue. As a temporary workaround, consider disabling the CURLOPT FOLLOWLOCATION option when open basedir or safe mode is enabled.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2006-4483

Affected Products

Php

References · 17

• http://php.net/release_5_1_5.php · Vendor Advisory
• http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-4483 · Security Note
• http://secunia.com/advisories/21546 · Vendor Advisory
• http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 · Patch
• http://php.net/ChangeLog-5.php#5.1.5 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_52_php.html · Vendor Advisory
• http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log · Patch
• http://secunia.com/advisories/22039 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4483 · Note
• http://vupen.com/english/advisories/2006/3318 · Note
• http://frsirt.com/english/advisories/2006/3318 · Note
• http://securityfocus.com/archive/1/492671/100/0/threaded · Note
• http://securityfocus.com/bid/19582 · Note
• http://secunia.com/advisories/30411 · Note