CVSS: 6.2EPSS: 0%CPEs: 54EXPL: 6CVE-2006-5178 – PHP 5.2.12/5.3.1 - 'symlink()' open_basedir Bypass
https://notcve.org/view.php?id=CVE-2006-5178
Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink. Condición de carrera en la función symlink en PHP 5.1.6 y anteriores permite a usuarios locales evitar la restricción open_basedir usando una combinación de las funciones symlink, mkdir, y unlink para cambiar la ruta de archivo tras la comprobación de open_basedir y antes de que el archivo es abierto por el sistema subyacente, como ha sido demostrado enlazando simbólicamente un enlace simbólico dentro de un subdirectorio, para que apunte a un directorio padre mediante secuencias .. (punto punto), y entonces desenlazar el enlace simbólico resultante. • https://www.exploit-db.com/exploits/10557 http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/049850.html http://secunia.com/advisories/22235 http://secunia.com/advisories/22424 http://securityreason.com/securityalert/1692 http://securitytracker.com/id?1016977 http://www.hardened-php.net/advisory_082006.132.html http://www.mandriva.com/security/advisories?name=MDKSA-2006:185 http://www.neosecurityteam.net/index.php?action=advisories&id=26 http://www.securityfocus.com/archive&#x • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 3.6EPSS: 0%CPEs: 54EXPL: 3CVE-2006-4625 – PHP 3 < 5 - Ini_Restore() 'Safe_mode' / 'open_basedir' Restriction Bypass
https://notcve.org/view.php?id=CVE-2006-4625
PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults. PHP 4.x up a 4.4.4 y PHP 5 up a 5.1.6, permite a un usuario local evitar las opciones httpd.conf del Apache HTTP Server, al igual que safe_mode y open_basedir, a través de la función ini_restore, lo cual restaura los valores de su php.ini (valor Master) por defecto. PHP versions 5.1.6 and below and versions 4.4.4 and below suffer from a php_admin* bypass via ini_restore(). • https://www.exploit-db.com/exploits/28504 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137 http://lists.suse.com/archive/suse-security-announce/2006-Oct/0002.html http://secunia.com/advisories/22282 http://secunia.com/advisories/22331 http://secunia.com/advisories/22338 http://secunia.com/advisories/22424 http://secunia.com/advisories/25423 http: •
CVSS: 9.3EPSS: 1%CPEs: 5EXPL: 0CVE-2006-4482
https://notcve.org/view.php?id=CVE-2006-4482
Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990. Múltiples vulnerabilidades de desbordamiento de búfer en las funciones (1) str_repeat y (2) wordwrap en ext/standard/string.c en PHP anterior a 5.1.5, cuando se uso sobre sistemas de 64-bit, tiene un impacto desconocido y ataque a vectores, una vulnerabilidad diferente que la CVE-2006-1990. • ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.10&r2=1.445.2.14.2.11 http://rhn.redhat.com/errata/RHSA-2006-0688.html http://secunia.com/advisories/21546 http://secunia.com/advisories/21768 http://secunia.com/advisories/22004 http://secunia.com/advisories/22039 http://secunia.com/advisories/22069 http://secunia.com/advisories/22225 http://secunia.com/ • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 2%CPEs: 1EXPL: 0CVE-2006-4483
https://notcve.org/view.php?id=CVE-2006-4483
The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache. Los ficheros con extensión cURL (1) ext/curl/interface.c y(2) ext/curl/streams.c en PHP anterior a 5.1.5 permite la opción CURLOPT_FOLLOWLOCATION cuando open_basedir o safe_mode está habilitado, lo cual permite a un atacante realizar acciones no autorizadas, posiblemente relacionado con la caché realpath. • http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4 http://secunia.com/advisories/21546 http://secunia.com/advisories/22039 http://secunia.com/advisories/30411 http://securitytracker.com/id?1016984 http://wiki.rpath.com/wiki/Advisor • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 3%CPEs: 65EXPL: 0CVE-2006-4433
https://notcve.org/view.php?id=CVE-2006-4433
PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation. PHP anterior a 4.4.3 y 5.x anterior a 5.1.4 no limita el conjunto de caracteres del identificador de sesión (PHPSESSID) para manejadores de sesión de terceros, lo cual puede hacer más fácil a atacantes remotos explotar otras vulnerabilidades insertando código PHP en el PHPSESSID, que es guardado en el fichero de sesión. NOTA: puede ser argumentado que no es una vulnerabilidad en PHP en si misma, sino más bien una limitación de diseño que habilita ciertos ataques sobre manejadores de sesión que no tienen en cuenta esta limitación. • http://secunia.com/advisories/21573 http://securityreason.com/securityalert/1466 http://www.hardened-php.net/advisory_052006.128.html http://www.osvdb.org/28233 http://www.osvdb.org/28273 http://www.securityfocus.com/archive/1/444263/100/0/threaded http://www.vupen.com/english/advisories/2006/3388 •