CVE-2006-4625: Low severity php php vulnerability

Published Sep 12, 2006

Updated

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safemode and openbasedir, via the inirestore function, which resets the values to their php.ini (Master Value) defaults.

Affected Software

54 affected components

PHP PHP=4.3.9

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=4.4.4

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=4.0.7-rc2

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=4.4.3

PHP PHP=5.0.3

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.0.1-patch1

PHP PHP=4.0

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=4.0.7-rc3

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0.3

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

Remediation

Patch Available

http://securityreason.com/achievement_securityalert/42

Event History

Sep 12, 2006

CVE Published

04:07 PM

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-4625?

CVE-2006-4625 is categorized as a high severity vulnerability due to its potential to allow unauthorized access and control over PHP execution settings.

How do I fix CVE-2006-4625?

To fix CVE-2006-4625, upgrade to PHP version 5.1.7 or later, as it addresses the vulnerability.

Which versions of PHP are affected by CVE-2006-4625?

CVE-2006-4625 affects PHP versions 4.x up to 4.4.4 and PHP 5 up to 5.1.6.

What are the implications of CVE-2006-4625 for web servers?

CVE-2006-4625 can allow local users to bypass security measures like safe_mode and open_basedir, potentially compromising the server's security.

Is CVE-2006-4625 a remote or local vulnerability?

CVE-2006-4625 is a local vulnerability, meaning it requires local access to exploit.