CVE ID:	CVE-2006-3016
Description:	Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2006-3016 BugTraq ID: 17843 http://www.securityfocus.com/bid/17843 Bugtraq: 20061005 rPSA-2006-0182-1 php php-mysql php-pgsql (Google Search) http://www.securityfocus.com/archive/1/447866/100/0/threaded http://www.mandriva.com/security/advisories?name=MDKSA-2006:122 http://www.osvdb.org/25253 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10597 RedHat Security Advisories: RHSA-2006:0669 http://www.redhat.com/support/errata/RHSA-2006-0669.html RedHat Security Advisories: RHSA-2006:0682 http://www.redhat.com/support/errata/RHSA-2006-0682.html RedHat Security Advisories: RHSA-2006:0736 http://rhn.redhat.com/errata/RHSA-2006-0736.html http://securitytracker.com/id?1016306 http://secunia.com/advisories/19927 http://secunia.com/advisories/21050 http://secunia.com/advisories/22004 http://secunia.com/advisories/22069 http://secunia.com/advisories/22225 http://secunia.com/advisories/22440 http://secunia.com/advisories/22487 http://secunia.com/advisories/23247 SGI Security Advisory: 20061001-01-P ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc TurboLinux Advisory: TLSA-2006-38 http://www.turbolinux.com/security/2006/TLSA-2006-38.txt http://www.ubuntu.com/usn/usn-320-1