PHP contains a flaw that may allow a malicious local user to view arbitrary files and create or modify existing files with the same level of privelege as the web server. The issue is triggered when a script misuses the imap_open() function. It is possible that the flaw may allow reading arbitrary files or creating, renaming, or deleting existing files resulting in a loss of confidentiality or integrity.

The imap_open() function itself only provides the ability to view arbitrary files, resulting in a loss of confidentiality. However, it can be leveraged by other functions, such as imap_createmailbox, to obtain write access to any part of the filesystem the web server has priveleges, resulting in a loss of integrity.

Upgrade to version 4.4.4, 5.1.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Secunia Advisory ID: 18694 21050
• CVE ID: 2006-1017 (see also: NVD)
• Related OSVDB ID: 23534 23536 23537 23538
• SCIP VulDB ID: 2465
• ISS X-Force ID: 24964
• VUPEN Advisory: ADV-2006-0772
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-02/0538.html
• Vendor Specific Advisory URL: http://www.mandriva.com/security/advisories?name=MDKSA-2006:122
• Vendor Specific News/Changelog Entry: http://www.php.net/release_4_4_4.php
  http://www.php.net/release_5_1_5.php

• - ced.clergetfree.fr -