#VU110487 Path traversal in PHP - CVE-2006-1494
Vulnerability identifier: #VU110487
Vulnerability risk: Low
CVSSv4.0: N/A
CVE-ID:
CWE-ID:
CWE-22
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
PHP
Universal components / Libraries /
Scripting languages
Vendor: PHP Group
Description
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to create files in arbitrary directories via the tempnam function.
Mitigation
Install update from vendor's website.
Vulnerable software versions
PHP: 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.1, 4.1.1, 4.1.2, 4.2, 4.2.1, 4.2.2, 4.2.3, 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4, 4.4.1, 4.4.2, 5, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2
External links
https:ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U
https://rhn.redhat.com/errata/RHSA-2006-0549.html
https://secunia.com/advisories/19599
https://secunia.com/advisories/19775
https://secunia.com/advisories/19979
https://secunia.com/advisories/21031
https://secunia.com/advisories/21125
https://secunia.com/advisories/21135
https://secunia.com/advisories/21202
https://secunia.com/advisories/21252
https://secunia.com/advisories/21723
https://secunia.com/advisories/22225
https://securityreason.com/achievement_securityalert/36
https://securityreason.com/securityalert/677
https://securitytracker.com/id?1015881
https://support.avaya.com/elmodocs2/security/ASA-2006-175.htm
https://www.mandriva.com/security/advisories?name=MDKSA-2006:074
https://www.novell.com/linux/security/advisories/05-05-2006.html
https://www.redhat.com/support/errata/RHSA-2006-0567.html
https://www.redhat.com/support/errata/RHSA-2006-0568.html
https://www.securityfocus.com/archive/1/447866/100/0/threaded
https://www.securityfocus.com/bid/17439
https://www.ubuntu.com/usn/usn-320-1
https://www.vupen.com/english/advisories/2006/1290
https://exchange.xforce.ibmcloud.com/vulnerabilities/25705
https://issues.rpath.com/browse/RPL-683
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10196
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
