CVE-2006-1608: Low severity php php vulnerability

Published Apr 10, 2006

Updated

The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.

Affected Software

65 affected components

PHP PHP=4.3.9

PHP PHP=4.0-beta1

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=5.0.1

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

Remediation

Patch Available

http://secunia.com/advisories/19599

Patch Available

http://securityreason.com/achievement_securityalert/37

Event History

Apr 10, 2006

CVE Published

07:02 PM

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1608?

CVE-2006-1608 has a moderate severity level due to the potential for local users to bypass safe mode and access sensitive files.

How do I fix CVE-2006-1608?

To fix CVE-2006-1608, users should upgrade to a version of PHP that is not affected, specifically versions beyond 5.1.2 or 4.4.3.

What versions of PHP are affected by CVE-2006-1608?

CVE-2006-1608 affects PHP versions 4.4.2, 5.1.2, and several earlier versions listed in the vulnerability details.

Can CVE-2006-1608 be exploited remotely?

CVE-2006-1608 is primarily a local vulnerability, meaning it requires access to the local server environment for exploitation.

What is the nature of the attack related to CVE-2006-1608?

The attack related to CVE-2006-1608 involves exploiting the copy function to use a compress.zlib:// URI, allowing unauthorized access to arbitrary files.

CVE-2006-1608: Low severity php php vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2006-1608?

How do I fix CVE-2006-1608?

What versions of PHP are affected by CVE-2006-1608?

Can CVE-2006-1608 be exploited remotely?

What is the nature of the attack related to CVE-2006-1608?

Company

Resources

Contact