CVE-2006-4483 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2006-4483
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2006-4483

Description: The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache.

CVE Status: Candidate

References: SUSE http://www.novell.com/linux/security/advisories/2006_52_php.html ST 1016984 SAID Secunia Advisory: SA21546 Secunia Advisory: SA22039 Secunia Advisory: SA30411 MISC http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4 CONFIRM http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178 http://www.php.net/release_5_1_5.php http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log http://www.php.net/ChangeLog-5.php#5.1.5 BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/492671/100/0/threaded BID 19582

Return to the previous page.