CVE-2006-3011: Medium severity PHP PHP vulnerability

Q: What is the severity of CVE-2006-3011?

CVE-2006-3011 is considered a high-severity vulnerability as it allows local users to bypass security restrictions.

Q: How do I fix CVE-2006-3011?

To mitigate CVE-2006-3011, upgrade PHP to versions 4.4.4 or later, or 5.1.5 or later.

Q: Who is affected by CVE-2006-3011?

CVE-2006-3011 affects PHP versions prior to 4.4.4 and 5.x versions before 5.1.5.

Q: What systems are vulnerable to CVE-2006-3011?

Any system running the affected versions of PHP, particularly PHP 4.x and 5.x prior to the specified updates, is vulnerable.

Q: What is the impact of CVE-2006-3011 on PHP applications?

CVE-2006-3011 can lead to unauthorized access and exploitation of PHP applications due to disabled safe mode and open_basedir restrictions.

Published Jun 26, 2006

Updated

The errorlog function in basicfunctions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and openbasedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.

Affected Software

77 affected components

PHP PHP=4.3.9

PHP PHP=3.0

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=3.0.8

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=4.3.7

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=4.0-beta2

PHP PHP=2.0b10

PHP PHP=4.0.6

PHP PHP=4.1.2

PHP PHP=4.3.1

PHP PHP=3.0.18

PHP PHP<=4.4.3

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=3.0.12

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.1.2

PHP PHP=5.1.1

PHP PHP=5.0.0-beta1

PHP PHP=5.1.6

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.0.4

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.0.0-rc3

PHP PHP=5.0.0-beta3

PHP PHP=5.1.3

PHP PHP=5.0.0-rc1

PHP PHP=5.0.2

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=5.0.0-beta2

Remediation

Patch Available

http://secunia.com/advisories/21546

Event History

Jun 26, 2006

CVE Published

09:05 PM

Jun 27, 2006

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3011?

CVE-2006-3011 is considered a high-severity vulnerability as it allows local users to bypass security restrictions.

How do I fix CVE-2006-3011?