CVE-2006-7243

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.

References

http://bugs.php.net/39863

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159031.html

http://marc.info/?l=bugtraq&m=132871655717248&w=2

http://marc.info/?l=bugtraq&m=133469208622507&w=2

http://openwall.com/lists/oss-security/2010/11/18/4

http://openwall.com/lists/oss-security/2010/11/18/5

http://openwall.com/lists/oss-security/2010/12/09/10

http://openwall.com/lists/oss-security/2010/12/09/11

http://openwall.com/lists/oss-security/2010/12/09/9

http://rhn.redhat.com/errata/RHSA-2013-1307.html

http://rhn.redhat.com/errata/RHSA-2013-1615.html

http://rhn.redhat.com/errata/RHSA-2014-0311.html

http://secunia.com/advisories/55078

http://support.apple.com/kb/HT4581

http://svn.php.net/viewvc?view=revision&revision=305412

http://svn.php.net/viewvc?view=revision&revision=305507

http://www.madirish.net/?article=436

http://www.mandriva.com/security/advisories?name=MDVSA-2010:254

http://www.php.net/archive/2010.php#id2010-12-10-1

http://www.php.net/ChangeLog-5.php

http://www.php.net/releases/5_3_4.php

http://www.securityfocus.com/bid/44951

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12569

Details

Source: MITRE

Published: 2011-01-18

Updated: 2018-10-30

Type: CWE-20

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:php:php:1.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:2.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:2.0b10:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.7:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.8:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.9:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.10:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.11:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.12:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.13:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.14:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.15:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.16:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.17:*:*:*:*:*:*:*

cpe:2.3:a:php:php:3.0.18:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.7:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.8:*:*:*:*:*:*:*

cpe:2.3:a:php:php:4.4.9:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.4:*:windows:*:*:*:*:*

cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.13:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.2.17:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*

cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions up to 5.3.3 (inclusive)

Tenable Plugins

View all (38 total)

IDNameProductFamilySeverity
98832PHP 5.6.x < 5.6.9 Multiple VulnerabilitiesWeb Application ScanningComponent Vulnerability
critical
93161SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)NessusSuSE Local Security Checks
critical
88065F5 Networks BIG-IP : PHP vulnerabilities (SOL16993)NessusF5 Networks Local Security Checks
high
85566Tenable SecurityCenter Multiple PHP Vulnerabilities (TNS-2015-06)NessusMisc.
critical
8786PHP 5.6.x < 5.6.9 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high
8785PHP 5.4.x < 5.4.41 / 5.5.x < 5.5.25 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high
84127Slackware 14.0 / 14.1 / current : php (SSA:2015-162-02)NessusSlackware Local Security Checks
high
83896Fedora 21 : php-5.6.9-1.fc21 (2015-8383)NessusFedora Local Security Checks
high
83895Fedora 20 : php-5.5.25-1.fc20 (2015-8370)NessusFedora Local Security Checks
high
83835Fedora 22 : php-5.6.9-1.fc22 (2015-8281)NessusFedora Local Security Checks
high
83519PHP 5.6.x < 5.6.9 Multiple VulnerabilitiesNessusCGI abuses
critical
83518PHP 5.5.x < 5.5.25 Multiple VulnerabilitiesNessusCGI abuses
high
83517PHP 5.4.x < 5.4.41 Multiple VulnerabilitiesNessusCGI abuses
critical
79167CentOS 6 : php (CESA-2013:1615)NessusCentOS Local Security Checks
medium
79149CentOS 5 : php53 (CESA-2013:1307)NessusCentOS Local Security Checks
critical
78134F5 Networks BIG-IP : Multiple PHP vulnerabilities (K13519)NessusF5 Networks Local Security Checks
critical
73115Scientific Linux Security Update : php on SL5.x i386/x86_64 (20140318)NessusScientific Linux Local Security Checks
medium
73091RHEL 5 : php (RHSA-2014:0311)NessusRed Hat Local Security Checks
medium
73089Oracle Linux 5 : php (ELSA-2014-0311)NessusOracle Linux Local Security Checks
medium
73085CentOS 5 : php (CESA-2014:0311)NessusCentOS Local Security Checks
medium
71198Scientific Linux Security Update : php on SL6.x i386/x86_64 (20131121)NessusScientific Linux Local Security Checks
medium
71107Oracle Linux 6 : php (ELSA-2013-1615)NessusOracle Linux Local Security Checks
medium
71010RHEL 6 : php (RHSA-2013:1615)NessusRed Hat Local Security Checks
medium
70389Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20130930)NessusScientific Linux Local Security Checks
critical
70284Oracle Linux 5 : php53 (ELSA-2013-1307)NessusOracle Linux Local Security Checks
critical
70244RHEL 5 : php53 (RHSA-2013:1307)NessusRed Hat Local Security Checks
critical
56459GLSA-201110-06 : PHP: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
55087Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 / 11.04 : php5 regressions (USN-1126-2)NessusUbuntu Local Security Checks
high
55086Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 / 11.04 : php5 vulnerabilities (USN-1126-1)NessusUbuntu Local Security Checks
high
52754Mac OS X 10.6.x < 10.6.7 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
high
800796Mac OS X 10.6 < 10.6.7 Multiple VulnerabilitiesLog Correlation EngineOperating System Detection
high
5826Mac OS X 10.6 < 10.6.7 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
51505FreeBSD : php -- NULL byte poisoning (3761df02-0f9c-11e0-becc-0022156e8794)NessusFreeBSD Local Security Checks
medium
51196Mandriva Linux Security Advisory : php (MDVSA-2010:254)NessusMandriva Local Security Checks
medium
51152FreeBSD : php -- multiple vulnerabilities (5353)NessusFreeBSD Local Security Checks
medium
51140PHP 5.3 < 5.3.4 Multiple VulnerabilitiesNessusCGI abuses
medium
801074PHP 5.3 < 5.3.4 Multiple VulnerabilitiesLog Correlation EngineWeb Servers
high
5732PHP 5.3.x < 5.3.4 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high