Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2006-4483

The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache.

Published

2006-08-31T21:04:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

10.0

Weaknesses

Type: Primary
CWE-862

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	php	php	< 5.1.5	Yes

References

http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 Broken Link, Patch ([email protected])
http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log Broken Link, Patch ([email protected])
http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4 Broken Link, Patch ([email protected])
http://secunia.com/advisories/21546 Not Applicable, Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/22039 Not Applicable ([email protected])
http://secunia.com/advisories/30411 Not Applicable ([email protected])
http://securitytracker.com/id?1016984 Broken Link, Third Party Advisory, VDB Entry ([email protected])
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178 Broken Link ([email protected])
http://www.novell.com/linux/security/advisories/2006_52_php.html Broken Link ([email protected])
http://www.php.net/ChangeLog-5.php#5.1.5 Release Notes, Vendor Advisory ([email protected])
http://www.php.net/release_5_1_5.php Patch, Release Notes, Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/492671/100/0/threaded Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/bid/19582 Third Party Advisory, VDB Entry ([email protected])
http://www.vupen.com/english/advisories/2006/3318 Permissions Required ([email protected])
http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 Broken Link, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log Broken Link, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4 Broken Link, Patch (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/21546 Not Applicable, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/22039 Not Applicable (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/30411 Not Applicable (af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1016984 Broken Link, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://www.novell.com/linux/security/advisories/2006_52_php.html Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://www.php.net/ChangeLog-5.php#5.1.5 Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.php.net/release_5_1_5.php Patch, Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/492671/100/0/threaded Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/19582 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2006/3318 Permissions Required (af854a3a-2127-422b-91ae-364da2661108)