CVE-2006-4433: High severity PHP PHP vulnerability

Published Aug 29, 2006

Updated

PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.

Affected Software

65 affected components

PHP PHP=4.3.9

PHP PHP=4.0-beta1

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=5.0.1

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

Remediation

Patch Available

http://secunia.com/advisories/21573

Patch Available

http://www.hardened-php.net/advisory_052006.128.html

Event History

Aug 29, 2006

CVE Published

12:04 AM

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-4433?

CVE-2006-4433 is considered a medium-severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2006-4433?

To fix CVE-2006-4433, upgrade PHP to versions 4.4.3 or 5.1.4 and later.

What systems are affected by CVE-2006-4433?

CVE-2006-4433 affects PHP versions prior to 4.4.3 and 5.x prior to 5.1.4.

What type of vulnerability is CVE-2006-4433?

CVE-2006-4433 is a session hijacking vulnerability that allows malicious users to inject PHP code into session identifiers.

Can CVE-2006-4433 lead to data compromise?

Yes, CVE-2006-4433 can potentially lead to unauthorized access and data compromise due to the ability to execute arbitrary PHP code.

CVE-2006-4433: High severity PHP PHP vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2006-4433?

How do I fix CVE-2006-4433?

What systems are affected by CVE-2006-4433?

What type of vulnerability is CVE-2006-4433?

Can CVE-2006-4433 lead to data compromise?

Company

Resources

Contact