PHP Error_Log Safe_Mode Restriction-Bypass Vulnerability

Bugtraq ID:	18645
Class:	Input Validation Error
CVE:	CVE-2006-3011
Remote:	No
Local:	Yes
Published:	Jun 26 2006 12:00AM
Updated:	Sep 01 2006 04:38PM
Credit:	Maksymilian Arciemowicz discovered these issues.
Vulnerable:	PHP PHP 5.1.4 PHP PHP 4.4.2 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0
Not Vulnerable:

PHP Error_Log Safe_Mode Restriction-Bypass Vulnerability

PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, with the 'safe_mode' and 'open_basedir' restrictions assumed to isolate the users from each other.

This issue is reported to affect PHP versions 4.4.2 and 5.1.4; other versions may also be vulnerable.

PHP Error_Log Safe_Mode Restriction-Bypass Vulnerability

Attackers may exploit these issues with standard PHP code.

Example PHP code exploiting the 'error_log()' issue is available:

• /data/vulnerabilities/exploits/php-error_log-file-write.txt

PHP Error_Log Safe_Mode Restriction-Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Please see the referenced advisories for information on obtaining and applying fixes.

PHP Error_Log Safe_Mode Restriction-Bypass Vulnerability

References:

• error_log() Safe Mode Bypass PHP 5.1.4 and 4.4.2 (Maksymilian Arciemowicz)
  
• Manpage for PHP error_log() function (PHP)
  
• PHP Homepage (PHP)