CVE-2006-7243
MEDIUM severity · CVSS 5 · Improper input validation
5CVSS MEDIUM
Summary
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impact—
Availability impactNone
Exploit probability (EPSS)5%
AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://bugs.php.net/39863 ↗
Additional information
- NVD record
- http://bugs.php.net/39863Patch
- http://openwall.com/lists/oss-security/2010/11/18/4Patch
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159031.html
- http://marc.info/?l=bugtraq&m=132871655717248&w=2
- http://marc.info/?l=bugtraq&m=133469208622507&w=2