CVE-2006-6383: Input Validation

Published Dec 10, 2006

Updated

PHP 5.2.0 and 4.4 allows local users to bypass safemode and openbasedir restrictions via a malicious path and a null byte before a ";" in a sessionsavepath argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.savepath to the malicious path.

Affected Software

2 affected components

PHP PHP=5.2.0

PHP PHP=4.4.0

Event History

Dec 10, 2006

CVE Published

08:28 PM

Data Sourced

via NVD·08:28 PM

DescriptionSeverityWeaknessAffected Software

Dec 11, 2006

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-6383?

CVE-2006-6383 is considered a critical vulnerability as it allows local users to bypass security restrictions.

How do I fix CVE-2006-6383?

To fix CVE-2006-6383, upgrade to a version of PHP that is newer than 5.2.0 and 4.4.0.

Who is affected by CVE-2006-6383?

CVE-2006-6383 affects users running PHP versions 5.2.0 and 4.4.0.

What types of restrictions can be bypassed with CVE-2006-6383?

CVE-2006-6383 allows bypassing of safe_mode and open_basedir restrictions.

What is the impact of CVE-2006-6383?

The impact of CVE-2006-6383 is that it compromises the integrity of session handling in PHP, potentially leading to unauthorized access.