#38804 [NEW]: bypass php_admin_value configuration

From: youza at post dot cz Operating system: Linux Fedora FC4 PHP version: 4.4.4 PHP Bug Type: Safe Mode/open_basedir Bug description: bypass php_admin_value configuration Description: ------------ http://securityreason.com/achievement_securityalert/42 http://www.securityfocus.com/archive/1/445651/30/30/threaded [PHP 5.1.6 / 4.4.4 Critical php_admin* bypass by ini_restore()] Author: Maksymilian Arciemowicz (cXIb8O3) Date: - - Written: 05.09.2006 - - Public: 09.09.2006 SecurityAlert Id: 42 CVE: CVE-2006-4625 SecurityRisk: High Affected Software: PHP 5.1.6 / 4.4.4 < = x Advisory URL: http://securityreason.com/achievement_securityalert/42 -- Edit bug report at http://bugs.php.net/?id=38804&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38804&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38804&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38804&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38804&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38804&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38804&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38804&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38804&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38804&r=support Expected behavior: http://bugs.php.net/fix.php?id=38804&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38804&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38804&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38804&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38804&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38804&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38804&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38804&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38804&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38804&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38804&r=mysqlcfg