Vulnerabilities > CVE-2006-4433 - Unspecified vulnerability in PHP

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

php

nessus

NVD

Published: 2006-08-29

Updated: 2024-11-21

Summary

PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.

Vulnerable Configurations

Part	Description	Count
Application	Php PHP PHP 4.3.9 PHP PHP 4.0 PHP PHP 5.1.2 PHP PHP 4.2.0 PHP PHP 5.1.1 PHP PHP 5.0.0 PHP PHP 4.1.0 PHP PHP 4.3.4 PHP PHP 4.0.4 PHP PHP 4.3.0 PHP PHP 4.0.5 PHP PHP 5.0 PHP PHP 5.0.5 PHP PHP 4.3.6 PHP PHP 5.0.1 PHP PHP 4.0.7 PHP PHP 4.3.7 PHP PHP 5.0.4 PHP PHP 4.2.2 PHP PHP 4.4.2 PHP PHP 4.3.2 PHP PHP 4.3.11 PHP PHP 4.0.0 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.3.3 PHP PHP 4.1.1 PHP PHP 5.0.3 PHP PHP 4.2.3 PHP PHP 5.1.0 PHP PHP 4.0.1 PHP PHP 4.0.6 PHP PHP 4.1.2 PHP PHP 4.3.1 PHP PHP 4.4.0 PHP PHP 4.3.10 PHP PHP 4.2.1 PHP PHP 5.0.2 PHP PHP 4.2 PHP PHP 4.4.1 PHP PHP 4.3.8 PHP PHP 4.3.5	65

Nessus

NASL family	CGI abuses
NASL id	PHP_4_4_3.NASL
description	According to its banner, the version of PHP installed on the remote host is older than 4.4.3 / 5.1.4. Such versions may be affected by several issues, including a buffer overflow, heap corruption, and a flaw by which a variable may survive a call to
last seen	2020-06-01
modified	2020-06-02
plugin id	22268
published	2006-08-25
reporter	This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/22268
title	PHP < 4.4.3 / 5.1.4 Multiple Vulnerabilities

Statements

contributor	Tomas Hoger
lastmodified	2008-10-30
organization	Red Hat
statement	We do not consider this to be a PHP flaw. The problem is caused by the insufficient input validation performed by Zend platform.

Summary

Vulnerable Configurations

Nessus

Statements

References