|
|
CVE Reference: CVE-2006-6383 |
|
| NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE. | |
|
Original Page at CVE MITRE: CVE-2006-6383 |
|
|
Description: PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path. |
|
|
CVE Status: Candidate |
|
|
References: SUSE http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html SREASONRES http://securityreason.com/achievement_securityalert/43 SREASON http://securityreason.com/securityalert/2000 SAID Secunia Advisory: SA24022 Secunia Advisory: SA24514 OPENPKG http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.010.html MANDRIVA http://www.mandriva.com/security/advisories?name=MDKSA-2007:038 CONFIRM http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.336.2.53.2.7&r2=1.336.2.53.2.8 BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/453938/30/9270/threaded BID 21508 |
|
| Return to the previous page. |
