Vulnerabilities > CVE-2006-1549 - Resource Management Errors vulnerability in PHP 4.4.2/5.1.2

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
php
CWE-399
nessus
exploit available
NVD
Published: 2006-04-10
Updated: 2024-11-21

Summary

PHP 4.4.2 and 5.1.2 allows local users to cause a crash (segmentation fault) by defining and executing a recursive function. NOTE: it has been reported by a reliable third party that some later versions are also affected.

Vulnerable Configurations

Part Description Count
Application
Php
2

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionPHP 4/5 Executor Deep Recursion Remote Denial of Service Vulnerability. CVE-2006-1549. Dos exploit for php platform
idEDB-ID:29693
last seen2016-02-03
modified2007-03-01
published2007-03-01
reporterMaksymilian Arciemowicz
sourcehttps://www.exploit-db.com/download/29693/
titlePHP 4/5 Executor Deep Recursion Remote Denial of Service Vulnerability

Nessus

NASL familyCGI abuses
NASL idPHP_5_2_0.NASL
descriptionAccording to its banner, the version of PHP 5.x installed on the remote host is older than 5.2. Such versions may be affected by several buffer overflows. To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script on the remote server or to manipulate several variables processed by some PHP functions such as
last seen2020-06-01
modified2020-06-02
plugin id31649
published2008-03-25
reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/31649
titlePHP 5.x < 5.2 Multiple Vulnerabilities

Statements

contributorMark J Cox
lastmodified2007-04-16
organizationRed Hat
statementThe PHP interpreter does not offer a reliable &quot;sandboxed&quot; security layer (as found in, say, a JVM) in which untrusted scripts can be run; any script run by the PHP interpreter must be trusted with the privileges of the interpreter itself. We therefore do not classify this issue as security-sensitive since no trust boundary is crossed.

References