CVE-2006-2660
First published: Tue Jun 13 2006(Updated: )
Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP | =4.3.9 | |
| PHP | =4.2.0 | |
| PHP | =4.1.0 | |
| PHP | =4.3.4 | |
| PHP | =4.0.4 | |
| PHP | =4.3.0 | |
| PHP | =4.0.5 | |
| PHP | =4.3.6 | |
| PHP | =5.1.4 | |
| PHP | =4.3.7 | |
| PHP | =4.2.2 | |
| PHP | =4.4.2 | |
| PHP | =4.3.2 | |
| PHP | =4.3.11 | |
| PHP | =4.0.0 | |
| PHP | =4.0.2 | |
| PHP | =4.3.3 | |
| PHP | =4.1.1 | |
| PHP | =4.4.3 | |
| PHP | =4.2.3 | |
| PHP | =4.1.2 | |
| PHP | =4.3.1 | |
| PHP | =4.4.0 | |
| PHP | =4.3.10 | |
| PHP | =4.2.1 | |
| PHP | =4.0.1 | |
| PHP | =4.4.1 | |
| PHP | =4.0.3 | |
| PHP | =4.3.8 | |
| PHP | =4.3.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cvs.php.net/viewcvs.cgi/php-src/NEWS?view=markup&rev=1.1247.2.920.2.134
- http://securitytracker.com/id?1016271
- http://www.ubuntu.com/usn/usn-320-1
- http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0209.html
- http://secunia.com/advisories/21125
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:122
- http://securityreason.com/securityalert/1069
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27049
- http://www.securityfocus.com/archive/1/436785/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2006-2660?
CVE-2006-2660 is categorized as a low-severity vulnerability due to its requirement for local access.
How do I fix CVE-2006-2660?
To mitigate CVE-2006-2660, update PHP to version 4.4.3 or later, or 5.2.0 and above.
What types of PHP versions are affected by CVE-2006-2660?
CVE-2006-2660 affects PHP versions 5.1.4 and 4.x before 4.4.3.
Who is impacted by the CVE-2006-2660 vulnerability?
Local users and attackers with access to the vulnerable PHP installation are impacted by CVE-2006-2660.
What is the nature of the vulnerability described in CVE-2006-2660?
CVE-2006-2660 is a buffer consumption vulnerability that allows local users to bypass restrictions when creating PHP files.
- agent/severity
- agent/references
- agent/author
- agent/event
- agent/weakness
- agent/type
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/nvd-historical
- vendor/php
- product/php
- canonical/php php
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/php
- version/php/4.3.9
- version/php/4.2.0
- version/php/4.1.0
- version/php/4.3.4
- version/php/4.0.4
- version/php/4.3.0
- version/php/4.0.5
- version/php/4.3.6
- version/php/5.1.4
- version/php/4.3.7
- version/php/4.2.2
- version/php/4.4.2
- version/php/4.3.2
- version/php/4.3.11
- version/php/4.0.0
- version/php/4.0.2
- version/php/4.3.3
- version/php/4.1.1
- version/php/4.4.3
- version/php/4.2.3
- version/php/4.1.2
- version/php/4.3.1
- version/php/4.4.0
- version/php/4.3.10
- version/php/4.2.1
- version/php/4.0.1
- version/php/4.4.1
- version/php/4.0.3
- version/php/4.3.8
- version/php/4.3.5