CVE-2006-1014: Low severity PHP PHP vulnerability

Published Mar 7, 2006

Updated

Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additionalparameters argument to the mbsendmail function, allows context-dependent attackers to read and create arbitrary files by providing extra -C and -X arguments to sendmail. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.

Affected Software

30 affected components

PHP PHP=4.3.9

PHP PHP=5.0.0-beta1

PHP PHP=4.3.4

PHP PHP=5.0-rc1

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=5.0.1

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.0.0-rc3

PHP PHP=5.0-rc2

PHP PHP=5.0.0-beta3

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=5.0.0-rc1

PHP PHP=5.0.2

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

Remediation

Patch Available

http://secunia.com/advisories/18694

Event History

Mar 7, 2006

CVE Published

12:02 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1014?

CVE-2006-1014 is considered a moderate severity vulnerability due to its potential to allow unauthorized file access and manipulation.

How do I fix CVE-2006-1014?

To mitigate CVE-2006-1014, update your PHP version to the latest stable release that addresses this vulnerability.

Which versions are affected by CVE-2006-1014?

CVE-2006-1014 affects PHP versions 4.0.0 to 5.1.0, specifically those that support the mb_send_mail function with sendmail.

What type of attacks can occur due to CVE-2006-1014?

CVE-2006-1014 allows attackers to read and create arbitrary files on the server by exploiting the additional_parameters argument.

Is CVE-2006-1014 an input validation issue?

Yes, CVE-2006-1014 is primarily an argument injection vulnerability that stems from improper handling of remote input.