PHP multipart/form-data POST parsing error allows arbitrary code ??

[elraj]

I read about this PHP this vulnerability from the Symantec site;

http://www.symantec.com/avcenter/security/Content/2208.html

and in the PHP official site, it says only PHP version 4.20 & 4.21 are affected. Please refer to : http://www.php.net/release_4_2_2.php

So, can anyone please tell me whether my PHP version 4.06, which I am using has this security hole as well ??

Thanks alot in advance 🙂

Best regards
EL Raj

[the_Igel]

PHP versions starting with 4.2.0 contain updated multipart/form-data handler code to intelligently parse HTTP POST request headers and differentiate variables and files sent by the user agent in a multipart/form-data request. The parser, however, fails to provide sufficient input checking in the way the mime headers are processed.

Isn't it said clear enough?

I just quote the page you've read, no more.

[elraj]

thanks