NVD Vulnerability Detail

CVE-2006-4020

Summary	scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.
Publication Date	Aug. 9, 2006, 5:04 a.m.
Registration Date	Jan. 29, 2021, 3:43 p.m.
Last Update	Feb. 14, 2024, 10:17 a.m.

CVSS2.0 : MEDIUM
Score	4.6
Vector	AV:L/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	はい
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:php:php:4.3.9:::::::*
cpe:2.3:a:php:php:4.0:beta1::::::
cpe:2.3:a:php:php:5.1.2:::::::*
cpe:2.3:a:php:php:4.0:beta4::::::
cpe:2.3:a:php:php:4.2.0:::::::*
cpe:2.3:a:php:php:5.1.1:::::::*
cpe:2.3:a:php:php:5.0.0:beta1::::::
cpe:2.3:a:php:php:4.1.0:::::::*
cpe:2.3:a:php:php:4.3.4:::::::*
cpe:2.3:a:php:php:4.0.4:::::::*
cpe:2.3:a:php:php:4.3.0:::::::*
cpe:2.3:a:php:php:4.0.5:::::::*
cpe:2.3:a:php:php:5.0:rc1::::::
cpe:2.3:a:php:php:5.0.5:::::::*
cpe:2.3:a:php:php:4.3.6:::::::*
cpe:2.3:a:php:php:5.0.1:::::::*
cpe:2.3:a:php:php:5.1.4:::::::*
cpe:2.3:a:php:php:4.0.7:rc2::::::
cpe:2.3:a:php:php:4.3.7:::::::*
cpe:2.3:a:php:php:5.0.4:::::::*
cpe:2.3:a:php:php:4.0.7:rc1::::::
cpe:2.3:a:php:php:4.2.2:::::::*
cpe:2.3:a:php:php:4.4.2:::::::*
cpe:2.3:a:php:php:4.0:rc1::::::
cpe:2.3:a:php:php:4.3.2:::::::*
cpe:2.3:a:php:php:4.3.11:::::::*
cpe:2.3:a:php:php:4.0.0:::::::*
cpe:2.3:a:php:php:4.0.3:patch1::::::
cpe:2.3:a:php:php:4.0.7:::::::*
cpe:2.3:a:php:php:4.0.2:::::::*
cpe:2.3:a:php:php:4.3.3:::::::*
cpe:2.3:a:php:php:5.0:rc3::::::
cpe:2.3:a:php:php:4.1.1:::::::*
cpe:2.3:a:php:php:4.4.3:::::::*
cpe:2.3:a:php:php:5.0.0:rc2::::::
cpe:2.3:a:php:php:5.0.3:::::::*
cpe:2.3:a:php:php:4.2.3:::::::*
cpe:2.3:a:php:php:5.1.0:::::::*
cpe:2.3:a:php:php:4.0.1:patch1::::::
cpe:2.3:a:php:php:5.0.0:rc3::::::
cpe:2.3:a:php:php:4.0:::::::*
cpe:2.3:a:php:php:4.0:beta2::::::
cpe:2.3:a:php:php:4.0.1:patch2::::::
cpe:2.3:a:php:php:4.0.6:::::::*
cpe:2.3:a:php:php:5.0:rc2::::::
cpe:2.3:a:php:php:4.1.2:::::::*
cpe:2.3:a:php:php:5.0.0:beta3::::::
cpe:2.3:a:php:php:4.0.7:rc3::::::
cpe:2.3:a:php:php:4.0:rc2::::::
cpe:2.3:a:php:php:4.3.1:::::::*
cpe:2.3:a:php:php:4.0:beta_4_patch1::::::
cpe:2.3:a:php:php:4.4.0:::::::*
cpe:2.3:a:php:php:4.3.10:::::::*
cpe:2.3:a:php:php:4.2.1:::::::*
cpe:2.3:a:php:php:5.0.0:rc1::::::
cpe:2.3:a:php:php:4.0.4:patch1::::::
cpe:2.3:a:php:php:4.0.1:::::::*
cpe:2.3:a:php:php:5.0.2:::::::*
cpe:2.3:a:php:php:4.2::dev:::::
cpe:2.3:a:php:php:4.4.1:::::::*
cpe:2.3:a:php:php:4.0:beta3::::::
cpe:2.3:a:php:php:4.0.3:::::::*
cpe:2.3:a:php:php:5.0.0:beta4::::::
cpe:2.3:a:php:php:5.0.0:::::::*
cpe:2.3:a:php:php:4.3.8:::::::*
cpe:2.3:a:php:php:4.3.5:::::::*
cpe:2.3:a:php:php:5.0.0:beta2::::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://www.securityfocus.com/archive/1/442438/30/0/threaded	BUGTRAQ	Exploit Patch Vendor Advisory
2	http://www.plain-text.info/sscanf_bug.txt	MISC	Exploit URL Repurposed
3	http://bugs.php.net/bug.php?id=38322	CONFIRM	Exploit Patch
4	http://www.securityfocus.com/bid/19415	BID
5	http://secunia.com/advisories/21403	SECUNIA
6	http://www.novell.com/linux/security/advisories/2006_19_sr.html	SUSE
7	http://www.novell.com/linux/security/advisories/2006_20_sr.html	SUSE
8	http://www.mandriva.com/security/advisories?name=MDKSA-2006:144	MANDRIVA
9	http://secunia.com/advisories/21608	SECUNIA
10	http://www.php.net/ChangeLog-5.php#5.1.5	CONFIRM
11	http://www.php.net/release_5_1_5.php	CONFIRM
12	http://security.gentoo.org/glsa/glsa-200608-28.xml	GENTOO
13	http://secunia.com/advisories/21546	SECUNIA
14	http://secunia.com/advisories/21683	SECUNIA
15	http://www.novell.com/linux/security/advisories/2006_22_sr.html	SUSE
16	http://www.ubuntu.com/usn/usn-342-1	UBUNTU
17	http://secunia.com/advisories/21768	SECUNIA
18	http://www.redhat.com/support/errata/RHSA-2006-0669.html	REDHAT
19	http://www.redhat.com/support/errata/RHSA-2006-0682.html	REDHAT
20	http://www.novell.com/linux/security/advisories/2006_52_php.html	SUSE
21	http://secunia.com/advisories/22004	SECUNIA
22	http://secunia.com/advisories/22069	SECUNIA
23	http://securitytracker.com/id?1016984	SECTRACK
24	http://support.avaya.com/elmodocs2/security/ASA-2006-221.htm	CONFIRM
25	http://support.avaya.com/elmodocs2/security/ASA-2006-222.htm	CONFIRM
26	http://secunia.com/advisories/22440	SECUNIA
27	http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm	CONFIRM
28	http://rhn.redhat.com/errata/RHSA-2006-0688.html	REDHAT
29	ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc	SGI
30	http://secunia.com/advisories/22538	SECUNIA
31	http://secunia.com/advisories/22487	SECUNIA
32	http://secunia.com/advisories/21847	SECUNIA
33	http://secunia.com/advisories/22039	SECUNIA
34	http://rhn.redhat.com/errata/RHSA-2006-0736.html	REDHAT
35	http://secunia.com/advisories/23247	SECUNIA
36	http://secunia.com/advisories/21467	SECUNIA
37	http://securityreason.com/securityalert/1341	SREASON
38	http://www.vupen.com/english/advisories/2006/3193	VUPEN
39	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11062	OVAL

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:php:php:4.3.9:::::::*
cpe:2.3:a:php:php:4.0:beta1::::::
cpe:2.3:a:php:php:5.1.2:::::::*
cpe:2.3:a:php:php:4.0:beta4::::::
cpe:2.3:a:php:php:4.2.0:::::::*
cpe:2.3:a:php:php:5.1.1:::::::*
cpe:2.3:a:php:php:5.0.0:beta1::::::
cpe:2.3:a:php:php:4.1.0:::::::*
cpe:2.3:a:php:php:4.3.4:::::::*
cpe:2.3:a:php:php:4.0.4:::::::*
cpe:2.3:a:php:php:4.3.0:::::::*
cpe:2.3:a:php:php:4.0.5:::::::*
cpe:2.3:a:php:php:5.0:rc1::::::
cpe:2.3:a:php:php:5.0.5:::::::*
cpe:2.3:a:php:php:4.3.6:::::::*
cpe:2.3:a:php:php:5.0.1:::::::*
cpe:2.3:a:php:php:5.1.4:::::::*
cpe:2.3:a:php:php:4.0.7:rc2::::::
cpe:2.3:a:php:php:4.3.7:::::::*
cpe:2.3:a:php:php:5.0.4:::::::*
cpe:2.3:a:php:php:4.0.7:rc1::::::
cpe:2.3:a:php:php:4.2.2:::::::*
cpe:2.3:a:php:php:4.4.2:::::::*
cpe:2.3:a:php:php:4.0:rc1::::::
cpe:2.3:a:php:php:4.3.2:::::::*
cpe:2.3:a:php:php:4.3.11:::::::*
cpe:2.3:a:php:php:4.0.0:::::::*
cpe:2.3:a:php:php:4.0.3:patch1::::::
cpe:2.3:a:php:php:4.0.7:::::::*
cpe:2.3:a:php:php:4.0.2:::::::*
cpe:2.3:a:php:php:4.3.3:::::::*
cpe:2.3:a:php:php:5.0:rc3::::::
cpe:2.3:a:php:php:4.1.1:::::::*
cpe:2.3:a:php:php:4.4.3:::::::*
cpe:2.3:a:php:php:5.0.0:rc2::::::
cpe:2.3:a:php:php:5.0.3:::::::*
cpe:2.3:a:php:php:4.2.3:::::::*
cpe:2.3:a:php:php:5.1.0:::::::*
cpe:2.3:a:php:php:4.0.1:patch1::::::
cpe:2.3:a:php:php:5.0.0:rc3::::::
cpe:2.3:a:php:php:4.0:::::::*
cpe:2.3:a:php:php:4.0:beta2::::::
cpe:2.3:a:php:php:4.0.1:patch2::::::
cpe:2.3:a:php:php:4.0.6:::::::*
cpe:2.3:a:php:php:5.0:rc2::::::
cpe:2.3:a:php:php:4.1.2:::::::*
cpe:2.3:a:php:php:5.0.0:beta3::::::
cpe:2.3:a:php:php:4.0.7:rc3::::::
cpe:2.3:a:php:php:4.0:rc2::::::
cpe:2.3:a:php:php:4.3.1:::::::*
cpe:2.3:a:php:php:4.0:beta_4_patch1::::::
cpe:2.3:a:php:php:4.4.0:::::::*
cpe:2.3:a:php:php:4.3.10:::::::*
cpe:2.3:a:php:php:4.2.1:::::::*
cpe:2.3:a:php:php:5.0.0:rc1::::::
cpe:2.3:a:php:php:4.0.4:patch1::::::
cpe:2.3:a:php:php:4.0.1:::::::*
cpe:2.3:a:php:php:5.0.2:::::::*
cpe:2.3:a:php:php:4.2::dev:::::
cpe:2.3:a:php:php:4.4.1:::::::*
cpe:2.3:a:php:php:4.0:beta3::::::
cpe:2.3:a:php:php:4.0.3:::::::*
cpe:2.3:a:php:php:5.0.0:beta4::::::
cpe:2.3:a:php:php:5.0.0:::::::*
cpe:2.3:a:php:php:4.3.8:::::::*
cpe:2.3:a:php:php:4.3.5:::::::*
cpe:2.3:a:php:php:5.0.0:beta2::::::