PHP Symbolic Link Open_Basedir Bypass Vulnerability

Bugtraq ID:	20326
Class:	Input Validation Error
CVE:	CVE-2006-5178
Remote:	No
Local:	Yes
Published:	Oct 03 2006 12:00AM
Updated:	Dec 22 2006 03:52PM
Credit:	Stefan Esser discovered this issue.
Vulnerable:	Turbolinux Turbolinux Server 10.0 x86 Turbolinux Turbolinux Server 10.0 Turbolinux Turbolinux 10 F... TurboLinux Personal TurboLinux Multimedia Turbolinux Home Turbolinux Appliance Server Workgroup Edition 1.0 Turbolinux Appliance Server Hosting Edition 1.0 Turbolinux Appliance Server 1.0 Workgroup Edition Turbolinux Appliance Server 1.0 Hosting Edition Turbolinux Appliance Server 2.0 TransSoft Broker FTP Server 8.0 PHP PHP 5.1.6 + Ubuntu Ubuntu Linux 6.10 sparc + Ubuntu Ubuntu Linux 6.10 powerpc + Ubuntu Ubuntu Linux 6.10 i386 + Ubuntu Ubuntu Linux 6.10 amd64 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 -RC1 PHP PHP 5.1.3 PHP PHP 5.1.2 + Ubuntu Ubuntu Linux 6.06 LTS sparc + Ubuntu Ubuntu Linux 6.06 LTS powerpc + Ubuntu Ubuntu Linux 6.06 LTS i386 + Ubuntu Ubuntu Linux 6.06 LTS amd64 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 + Trustix Secure Linux 2.2 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 5.0 .0 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 + Gentoo Linux + Redhat Fedora Core3 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 + Trustix Secure Linux 1.5 PHP PHP 4.3.9 PHP PHP 4.3.8 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + S.u.S.E. Linux Personal 9.2 + Turbolinux Turbolinux Server 10.0 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 + MandrakeSoft Corporate Server 3.0 x86_64 + MandrakeSoft Corporate Server 3.0 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + S.u.S.E. Linux Personal 9.1 PHP PHP 4.3.3 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + Turbolinux Home + Turbolinux Turbolinux 10 F... + Turbolinux Turbolinux Desktop 10.0 PHP PHP 4.3.2 PHP PHP 4.3.1 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + OpenPKG OpenPKG Current + S.u.S.E. Linux Personal 8.2 PHP PHP 4.3 PHP PHP 4.2.3 + EnGarde Secure Linux 1.0.1 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 PHP PHP 4.2.2 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2 + OpenPKG OpenPKG 1.1 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 + SuSE Linux 8.1 PHP PHP 4.2.1 - FreeBSD FreeBSD 4.6 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 + Slackware Linux 8.1 PHP PHP 4.2 .0 PHP PHP 4.2 -dev PHP PHP 4.1.2 + Apple Mac OS X 10.1.5 + Apple Mac OS X 10.1.4 + Apple Mac OS X 10.1.3 + Apple Mac OS X 10.1.2 + Apple Mac OS X 10.1.1 + Apple Mac OS X 10.1 + Apple Mac OS X 10.1 + Apple Mac OS X 10.0.4 + Apple Mac OS X 10.0.3 + Apple Mac OS X 10.0.2 + Apple Mac OS X 10.0.1 + Apple Mac OS X 10.0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + MandrakeSoft Multi Network Firewall 2.0 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 PHP PHP 4.0.7 RC3 PHP PHP 4.0.7 RC2 PHP PHP 4.0.7 RC1 PHP PHP 4.0.7 PHP PHP 4.0.6 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + HP Secure OS software for Linux 1.0 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 5.1 + MandrakeSoft Corporate Server 1.0.1 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 7.0 + Sun Cobalt RaQ 550 + Sun LX50 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 + SuSE Linux 7.2 i386 + SuSE Linux 7.2 + Trustix Secure Linux 1.5 PHP PHP 4.0.5 PHP PHP 4.0.4 + Compaq Compaq Secure Web Server PHP 1.0 + Guardian Digital Engarde Secure Linux 1.0.1 + SuSE Linux 7.2 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 7.0 PHP PHP 4.0.3 pl1 + SuSE Linux 6.4 ppc + SuSE Linux 6.4 i386 + SuSE Linux 6.4 alpha + SuSE Linux 6.4 PHP PHP 4.0.3 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 + Sun Cobalt Control Station 4100CS + Sun Cobalt Qube3 Japanese 4000WGJ + Sun Cobalt Qube3 Japanese w/ Caching and RAID 4100WGJ + Sun Cobalt Qube3 Japanese w/Caching 4010WGJ + Sun Cobalt RaQ XTR 3500R + Sun Cobalt RaQ XTR Japanese 3500R-ja PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 + Sun Cobalt Qube3 4000WG + Sun Cobalt Qube3 w/ Caching and RAID 4100WG + Sun Cobalt Qube3 w/Caching 4010WG + Sun Cobalt RaQ4 3001R + Sun Cobalt RaQ4 Japanese RAID 3100R-ja + Sun Cobalt RaQ4 RAID 3100R PHP PHP 4.0 0 OpenPKG OpenPKG Stable OpenPKG OpenPKG Current Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0
Not Vulnerable:

PHP Symbolic Link Open_Basedir Bypass Vulnerability

PHP is prone to an 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'open_basedir' restriction is expected to isolate users from each other.

This issue is reported to affect PHP versions 4 and 5.

PHP Symbolic Link Open_Basedir Bypass Vulnerability

Attackers may exploit this issue with standard PHP code.

A proof of concept is available:

• /data/vulnerabilities/exploits/php_openbasedir_poc.txt

PHP Symbolic Link Open_Basedir Bypass Vulnerability

Solution:
Please see the referenced advisories for more information.


PHP PHP 4.1.2

• Mandriva libphp_common432-4.3.4-4.21.M20mdk.i586.rpm
  Multi Network Firewall 2.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-4.3.4-4.21.M20mdk.i586.rpm
  Multi Network Firewall 2.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-4.3.4-4.21.M20mdk.i586.rpm
  Multi Network Firewall 2.0:
  http://www.mandriva.com/en/download


• Mandriva php432-devel-4.3.4-4.21.M20mdk.i586.rpm
  Multi Network Firewall 2.0:
  http://www.mandriva.com/en/download

PHP PHP 4.3.4

• Mandriva lib64php_common432-4.3.4-4.21.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva libphp_common432-4.3.4-4.21.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-4.3.4-4.21.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-4.3.4-4.21.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-4.3.4-4.21.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-4.3.4-4.21.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva php432-devel-4.3.4-4.21.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva php432-devel-4.3.4-4.21.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download

PHP PHP 4.4.4

• Mandriva php4-cgi-4.4.4-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php4-cli-4.4.4-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php4-devel-4.4.4-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download

PHP PHP 5.0.4

• Mandriva lib64php5_common5-5.0.4-9.16.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva libphp5_common5-5.0.4-9.16.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-5.0.4-9.16.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-5.0.4-9.16.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-5.0.4-9.16.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-5.0.4-9.16.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva php-devel-5.0.4-9.16.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva php-devel-5.0.4-9.16.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva php-fcgi-5.0.4-9.16.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva php-fcgi-5.0.4-9.16.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download

PHP PHP 5.1.6

• Mandriva lib64php5_common5-5.1.6-1.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva lib64php5_common5-5.1.6-1.2mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva libphp_common432-4.3.4-4.21.M20mdk.i586.rpm
  Multi Network Firewall 2.0:
  http://www.mandriva.com/en/download


• Mandriva libphp4_common4-4.4.4-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva libphp5_common5-5.1.6-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva libphp5_common5-5.1.6-1.2mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-5.1.6-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-5.1.6-1.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-5.1.6-1.2mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva php-cgi-5.1.6-1.2mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-5.1.6-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-5.1.6-1.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-5.1.6-1.2mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva php-cli-5.1.6-1.2mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva php-devel-5.1.6-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php-devel-5.1.6-1.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php-devel-5.1.6-1.2mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva php-devel-5.1.6-1.2mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva php-fcgi-5.1.6-1.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php-fcgi-5.1.6-1.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva php-fcgi-5.1.6-1.2mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva php-fcgi-5.1.6-1.2mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download

PHP Symbolic Link Open_Basedir Bypass Vulnerability

References:

• PHP Homepage (PHP)
  
• [Full-disclosure] Advisory 08/2006: PHP open_basedir Race Condition Vulnerabilit (Stefan Esser )
  
• OpenPKG-SA-2006.023-php (OpenPKG)