The ini_restore() method could be exploited to reset options set in the webserver config to their default values. (CVE-2006-4625)

The memory handling routines contained an integer overflow.
(CVE-2006-4812)

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults. (CVE-2006-4625)

A race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink. (CVE-2006-5178)

Because the design flaw cannot be solved it is strongly recommended to disable the symlink() function if you are using the open_basedir feature. You can achieve that by adding symlink to the list of disabled functions within your php.ini: disable_functions=...,symlink

The updated packages do not alter the system php.ini.

Updated packages have been patched to correct the CVE-2006-4625 issue.
Users must restart Apache for the changes to take effect.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.  Such versions may be affected by several buffer overflows. 

To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script on the remote server or to manipulate several variables processed by some PHP functions such as 'htmlentities().'

バナーによると、リモートホストにインストールされている PHP のバージョンは、4.4.5 より前です。このようなバージョンは、バッファオーバーフロー、フォーマット文字列の脆弱性、任意のコードの実行、「safe_mode」および「open_basedir」のバイパス、スーパーグローバルの上書きによるデータ破壊など、いくつかの問題の影響を受けることがあります。

バナーによると、リモートホストにインストールされている PHP 5.x のバージョンは、5.2 より前です。このようなバージョンは、いくつかのバッファオーバーフローの影響を受けることがあります。 

これらの問題を悪用するには、攻撃者に、リモートサーバーで任意の PHP スクリプトをアップロードするため、または「htmlentities()」などのいくつかの PHP の関数で処理された複数の変数を操作するための能力が、必要です。

根據其標題，遠端主機上安裝的 PHP 版本舊於 4.4.5。這些版本可能會受到多個問題的影響，包括緩衝區溢位、格式字串弱點、任意程式碼執行、「safe_mode」和「open_basedir」略過，以及超全域記憶體區域。

根据其标题，远程主机上安装的 PHP 版本早于 4.4.5。此类版本可能受到多个问题的影响，包括缓冲区溢出、格式字符串漏洞、任意代码执行、“safe_mode”和“open_basedir”绕过以及 super-global 重写。

根據其標題，遠端主機上安裝的 PHP 5.x 版本比 5.2 舊。這些版本可能受到多個緩衝區溢位影響。 

若要惡意利用這些問題，攻擊者需要可以將任意 PHP 指令碼上傳至遠端伺服器，或可以操作由 PHP 函數 (如「htmlentities()」) 處理的一些變數。

根据其标题，远程主机上安装的 PHP 5.x 版本低于 5.2。此类版本可能会受到多个缓冲区溢出的影响。 

为利用这些问题，攻击者需要能够在远程服务器上上传任意 PHP 脚本或操纵由“htmlentities()”等 PHP 函数处理的多个变量。

According to its banner, the version of PHP installed on the remote host is older than 4.4.5.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

The stripos() function did not check for invalidly long or empty haystack strings. In an application that uses this function on arbitrary untrusted data this could be exploited to crash the PHP interpreter. (CVE-2006-4485)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly. A remote attacker could exploit this to cause a Denial of Service attack through memory exhaustion. (CVE-2006-4486)

Maksymilian Arciemowicz discovered that security relevant configuration options like open_basedir and safe_mode (which can be configured in Apache's httpd.conf) could be bypassed and reset to their default value in php.ini by using the ini_restore() function.
(CVE-2006-4625)

Stefan Esser discovered that the ecalloc() function in the Zend engine did not check for integer overflows. This particularly affected the unserialize() function. In applications which unserialize untrusted user-defined data, this could be exploited to execute arbitrary code with the application's privileges. (CVE-2006-4812).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ini_restore() method could be exploited to reset options set in the webserver config to their default values (CVE-2006-4625).

The memory handling routines contained an integer overflow (CVE-2006-4812).

 According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.0.  Such versions may be affected by several buffer overflows To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script to the remote server, or to be able to manipulate several variables processed by some PHP functions such as htmlentities(). 

ID	名稱	產品	系列	已發布	已更新	嚴重性
29375	SuSE 10 Security Update : PHP (ZYPP Patch Number 2152)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	critical
24570	Mandrake Linux Security Advisory : php (MDKSA-2006:185)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	medium
31649	PHP 5.x < 5.2 Multiple Vulnerabilities	Nessus	CGI abuses	2008/3/25	2024/5/31	high
24906	PHP < 4.4.5 の複数の脆弱性	Nessus	CGI abuses	2007/4/2	2024/5/31	high
31649	PHP 5.x < 5.2 の複数の脆弱性	Nessus	CGI abuses	2008/3/25	2024/5/31	high
24906	PHP < 4.4.5 多種弱點	Nessus	CGI abuses	2007/4/2	2024/5/31	high
24906	PHP < 4.4.5 多种漏洞	Nessus	CGI abuses	2007/4/2	2024/5/31	high
31649	PHP 5.x < 5.2 多個弱點	Nessus	CGI abuses	2008/3/25	2024/5/31	high
31649	PHP 5.x < 5.2 多个漏洞	Nessus	CGI abuses	2008/3/25	2024/5/31	high
24906	PHP < 4.4.5 Multiple Vulnerabilities	Nessus	CGI abuses	2007/4/2	2024/5/31	high
27942	Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-362-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	critical
27147	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-2153)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	critical
4444	PHP 5.x < 5.2.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2008/3/25	2019/3/6	high

偵測

搜尋 Plugin

critical

medium

high

high

high

high

high

high

high

high

critical

critical

high