PHP Session.Save_Path() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
BID:21508
Info
PHP Session.Save_Path() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
| Bugtraq ID: | 21508 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-6383 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 08 2006 12:00AM |
| Updated: | Mar 15 2007 02:44PM |
| Credit: | Maksymilian Arciemowicz is credited with discovering this issue. |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10 SuSE Linux Enterprise Server 9 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 10.1 PHP PHP 5.2 OpenPKG OpenPKG Stable OpenPKG OpenPKG E1.0-Solid OpenPKG OpenPKG Current OpenPKG OpenPKG 2-Stable-20061018 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 |
| Not Vulnerable: | |
Discussion
PHP Session.Save_Path() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.
This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.
PHP version 5.2.0 is vulnerable to this issue.
PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.
This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.
PHP version 5.2.0 is vulnerable to this issue.
Exploit / POC
PHP Session.Save_Path() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
Attackers may exploit these issues with standard PHP code.
The following proof of concept is available:
session_save_path("/DIR/WHERE/YOU/DONT/HAVE/ACCESS\0;/DIR/WHERE/YOU/HAVE/ACCESS")
Attackers may exploit these issues with standard PHP code.
The following proof of concept is available:
session_save_path("/DIR/WHERE/YOU/DONT/HAVE/ACCESS\0;/DIR/WHERE/YOU/HAVE/ACCESS")
Solution / Fix
PHP Session.Save_Path() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
Solution:
The vendor released fixes in the CVS repository. Please see the references for more information.
OpenPKG OpenPKG E1.0-Solid
OpenPKG OpenPKG Stable
OpenPKG OpenPKG Current
Solution:
The vendor released fixes in the CVS repository. Please see the references for more information.
OpenPKG OpenPKG E1.0-Solid
-
OpenPKG apache-1.3.37-E1.0.2
OpenPKG Enterprise
ftp://ftp.openpkg.org/release -
OpenPKG php-5.1.6-E1.0.2
OpenPKG Enterprise
ftp://ftp.openpkg.org/release
OpenPKG OpenPKG Stable
-
OpenPKG apache-1.3.37-2.20070211
OpenPKG Enterprise
ftp://ftp.openpkg.org/release -
OpenPKG php-5.2.1-2.20070211
OpenPKG Enterprise
ftp://ftp.openpkg.org/release
OpenPKG OpenPKG Current
-
OpenPKG apache-1.3.37-20070208
OpenPKG Enterprise
ftp://ftp.openpkg.org/release -
OpenPKG php-5.2.1-20070208
OpenPKG Enterprise
ftp://ftp.openpkg.org/release
References
PHP Session.Save_Path() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
References:
References:
- PHP NEWS Changelog (PHP)
- SUSE-SA:2007:020 (SUSE)
- PHP 5.2.0 session.save_path safe_mode and open_basedir bypass (Maksymilian Arciemowicz)