PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.

 According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.0.  Such versions may be affected by several buffer overflows To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script to the remote server, or to be able to manipulate several variables processed by some PHP functions such as htmlentities(). 

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.  Such versions may be affected by several buffer overflows. 

To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script on the remote server or to manipulate several variables processed by some PHP functions such as 'htmlentities().'

The ini_restore() method could be exploited to reset options set in the webserver config to their default values. (CVE-2006-4625)

The memory handling routines contained an integer overflow.
(CVE-2006-4812)

The stripos() function did not check for invalidly long or empty haystack strings. In an application that uses this function on arbitrary untrusted data this could be exploited to crash the PHP interpreter. (CVE-2006-4485)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly. A remote attacker could exploit this to cause a Denial of Service attack through memory exhaustion. (CVE-2006-4486)

Maksymilian Arciemowicz discovered that security relevant configuration options like open_basedir and safe_mode (which can be configured in Apache's httpd.conf) could be bypassed and reset to their default value in php.ini by using the ini_restore() function.
(CVE-2006-4625)

Stefan Esser discovered that the ecalloc() function in the Zend engine did not check for integer overflows. This particularly affected the unserialize() function. In applications which unserialize untrusted user-defined data, this could be exploited to execute arbitrary code with the application's privileges. (CVE-2006-4812).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ini_restore() method could be exploited to reset options set in the webserver config to their default values (CVE-2006-4625).

The memory handling routines contained an integer overflow (CVE-2006-4812).

According to its banner, the version of PHP installed on the remote host is older than 4.4.5.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults. (CVE-2006-4625)

A race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink. (CVE-2006-5178)

Because the design flaw cannot be solved it is strongly recommended to disable the symlink() function if you are using the open_basedir feature. You can achieve that by adding symlink to the list of disabled functions within your php.ini: disable_functions=...,symlink

The updated packages do not alter the system php.ini.

Updated packages have been patched to correct the CVE-2006-4625 issue.
Users must restart Apache for the changes to take effect.

ID	Name	Product	Family	Severity
4444	PHP 5.x < 5.2.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
31649	PHP 5.x < 5.2 Multiple Vulnerabilities	Nessus	CGI abuses	high
29375	SuSE 10 Security Update : PHP (ZYPP Patch Number 2152)	Nessus	SuSE Local Security Checks	critical
27942	Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-362-1)	Nessus	Ubuntu Local Security Checks	critical
27147	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-2153)	Nessus	SuSE Local Security Checks	critical
24906	PHP < 4.4.5 Multiple Vulnerabilities	Nessus	CGI abuses	high
24570	Mandrake Linux Security Advisory : php (MDKSA-2006:185)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2006-4625

low

Tenable Plugins

high

high

critical

critical

critical

high

medium