The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings. NOTE: the error_log function is covered by CVE-2006-3011, and the imap_open function is covered by CVE-2006-1017.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.1.5.  Such versions may be affected by the following vulnerabilities :

  - The c-client library 2000, 2001, or 2004 for PHP does     not check the safe_mode or open_basedir functions.
    (CVE-2006-1017)

  - A buffer overflow exists in the sscanf function.
    (CVE-2006-4020)

  - The file_exists and imap_reopen functions do not check     for the safe_mode and open_basedir settings, which     allows local users to bypass the settings.     (CVE-2006-4481)

  - Multiple heap-based buffer overflows exist in the     str_repeat and wordwrap functions in     ext/standard/string.c. (CVE-2006-4482)

  - The cURL extension files permit the     CURLOPT_FOLLOWLOCATION option when open_basedir or     safe_mode is enabled, which allows attackers to perform     unauthorized actions. (CVE-2006-4483)

  - A buffer overflow vulnerability exists in the     LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the     GD extension. (CVE-2006-4484)

  - The stripos function is affected by an out-of-bounds     read. (CVE-2006-4485)

The sscanf() function did not properly check array boundaries. In applications which use sscanf() with argument swapping, a remote attacker could potentially exploit this to crash the affected web application or even execute arbitrary code with the application's privileges. (CVE-2006-4020)

The file_exists() and imap_reopen() functions did not perform proper open_basedir and safe_mode checks which could allow local scripts to bypass intended restrictions. (CVE-2006-4481)

On 64 bit systems the str_repeat() and wordwrap() functions did not properly check buffer boundaries. Depending on the application, this could potentially be exploited to execute arbitrary code with the applications' privileges. This only affects the amd64 and sparc platforms. (CVE-2006-4482)

A buffer overflow was discovered in the LWZReadByte_() function of the GIF image file parser. By tricking a PHP application into processing a specially crafted GIF image, a remote attacker could exploit this to execute arbitrary code with the application's privileges.
(CVE-2006-4484).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings (CVE-2006-4481).

Buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array (CVE-2006-4484).

The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read (CVE-2006-4485).

CVE-2006-4485 does not affect the Corporate3 or MNF2 versions of PHP.

Updated packages have been patched to correct these issues.

The remote host is running a version of PHP that is older than 4.4.4 or 5.1.5.  This version is reported vulnerable to several flaws that may allow an attacker with the right to execute PHP scripts the ability to execute arbitrary code.  Executed code would be run with the permissions of the web server process. 

The PHP development team reports :

- Added missing safe_mode/open_basedir checks inside the error_log(), file_exists(), imap_open() and imap_reopen() functions.

- Fixed overflows inside str_repeat() and wordwrap() functions on 64bit systems.

- Fixed possible open_basedir/safe_mode bypass in cURL extension and with realpath cache.

- Fixed overflow in GD extension on invalid GIF images.

- Fixed a buffer overflow inside sscanf() function.

- Fixed an out of bounds read inside stripos() function.

- Fixed memory_limit restriction on 64 bit system.

The remote host is running a version of PHP that is older than 4.4.4 or 5.1.5.  This version is reported vulnerable to several flaws that may allow an attacker with the right to execute PHP scripts the ability to execute arbitrary code.  Executed code would be run with the permissions of the web server process.

ID	Name	Product	Family	Severity
17713	PHP 5.1.x < 5.1.5 Multiple Vulnerabilities	Nessus	CGI abuses	critical
27921	Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-342-1)	Nessus	Ubuntu Local Security Checks	high
23906	Mandrake Linux Security Advisory : php (MDKSA-2006:162)	Nessus	Mandriva Local Security Checks	critical
3732	PHP 4.x < 4.4.4 / 5.x < 5.1.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
22343	FreeBSD : php -- multiple vulnerabilities (ea09c5df-4362-11db-81e1-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	critical
801073	PHP < 4.4.4 / 5.1.4 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2006-4481

medium

Tenable Plugins

critical

high

critical

medium

critical

high