PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
BID:23183
Info
PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
| Bugtraq ID: | 23183 |
| Class: | Design Error |
| CVE: |
CVE-2007-1835 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 28 2007 12:00AM |
| Updated: | Jun 29 2007 05:08PM |
| Credit: | Stefan Esser is credited with discovering this vulnerability. |
| Vulnerable: |
PHP PHP 5.2.1 PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 -RC1 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 5.0 .0 PHP PHP 4.4.6 PHP PHP 4.4.5 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 PHP PHP 4.3.9 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 4.2 -dev PHP PHP 4.1.2 PHP PHP 4.1.1 PHP PHP 4.1 .0 PHP PHP 4.0.7 RC3 PHP PHP 4.0.7 RC2 PHP PHP 4.0.7 RC1 PHP PHP 4.0.7 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 pl1 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 PHP PHP 4.0 0 PHP PHP 5.2 OpenPKG OpenPKG E1.0-Solid OpenPKG OpenPKG Current HP Tru64 UNIX Compaq Secure Web Server 6.3.2 a HP Tru64 UNIX Compaq Secure Web Server 6.3 HP Tru64 UNIX Compaq Secure Web Server 5.9.2 HP Tru64 UNIX Compaq Secure Web Server 5.9.1 HP Tru64 UNIX Compaq Secure Web Server 5.8.2 HP Tru64 UNIX Compaq Secure Web Server 5.8.1 HP Tru64 UNIX Compaq Secure Web Server 5.1 A HP Tru64 UNIX Compaq Secure Web Server 5.1 HP Tru64 UNIX Compaq Secure Web Server 5.0 A HP Tru64 UNIX Compaq Secure Web Server 4.0 G HP Tru64 UNIX Compaq Secure Web Server 4.0 F HP Systems Management HomePage 2.1.7.168 HP System Management Homepage 2.1.5 HP System Management Homepage 2.1.4 HP System Management Homepage 2.1.3 .132 HP System Management Homepage 2.1.3 HP System Management Homepage 2.1.2 HP System Management Homepage 2.1.1 HP System Management Homepage 2.1 HP System Management Homepage 2.0.2 HP System Management Homepage 2.0.1 HP System Management Homepage 2.0 HP Secure Web Server for HP Tru64 UNIX 6.6.4 HP Internet Express 6.0 HP Internet Express 5.9 HP Internet Express 5.8 HP Internet Express 5.7 HP Internet Express 5.4 HP Internet Express 6.6 HP Internet Express 6.4 HP Internet Express 6.3 |
| Not Vulnerable: |
HP Systems Management HomePage 2.1.8 HP Internet Express 6.7 |
Discussion
PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
PHP is prone to a 'open_basedir' restriction-bypass vulnerability due to a design error.
Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.
This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.
The following versions are vulnerable:
PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1
PHP is prone to a 'open_basedir' restriction-bypass vulnerability due to a design error.
Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.
This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.
The following versions are vulnerable:
PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1
Exploit / POC
PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
Attackers may exploit these issues by crafting and executing standard PHP code.
The following proof of concept is available:
Attackers may exploit these issues by crafting and executing standard PHP code.
The following proof of concept is available:
Solution / Fix
PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
Solution:
Please see the referenced advisories for further information.
HP Systems Management HomePage 2.1.7.168
HP Secure Web Server for HP Tru64 UNIX 6.6.4
Solution:
Please see the referenced advisories for further information.
HP Systems Management HomePage 2.1.7.168
-
HP HP System Management Homepage for Linux
http://h18023.www1.hp.com/support/files/server/us/download/26864.html -
HP HP System Management Homepage for Linux (AMD64/EM64T)
http://h18023.www1.hp.com/support/files/server/us/download/26866.html -
HP HP System Management Homepage for Windows
http://h18023.www1.hp.com/support/files/server/us/download/26977.html
HP Secure Web Server for HP Tru64 UNIX 6.6.4
-
HP sws_v6_6_5_kit.tar.gz
http://h30097.www3.hp.com/internet/download.htm#sws
References
PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
References:
References:
- HPSBMA02215 SSRT071423 (HP)
- PHP Homepage (PHP Group)
- MOPB-36-2007:PHP session.save_path open_basedir Bypass Vulnerability (Stefan Esser)