BID:29797

PHP 5 'posix_access()' Function 'safe_mode' Bypass Directory Traversal Vulnerability

Info

PHP 5 'posix_access()' Function 'safe_mode' Bypass Directory Traversal Vulnerability

Bugtraq ID:	29797
Class:	Input Validation Error
CVE:	CVE-2008-2665
Remote:	Yes
Local:	No
Published:	Jun 18 2008 12:00AM
Updated:	Oct 22 2009 11:38PM
Credit:	Maksymilian Arciemowicz of SecurityReason Research
Vulnerable:	Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux -current rPath rPath Linux 2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 2 rPath Appliance Platform Linux Service 1 PHP PHP 5.2.6 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.11 Gentoo Linux Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5

Not Vulnerable:	PHP PHP 5.2.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X 10.5.7

Discussion

PHP 5 'posix_access()' Function 'safe_mode' Bypass Directory Traversal Vulnerability

PHP is prone to a directory-traversal vulnerability because it fails to adequately sanitize user-supplied data.

Attackers can leverage this issue to bypass security restrictions enforced by 'safe_mode' to access data outside of the root webserver directory. Successful attacks may allow an attacker to access sensitive information that could aid in further attacks.

PHP 5.2.6 is vulnerable; other versions may also be affected.

Exploit / POC

PHP 5 'posix_access()' Function 'safe_mode' Bypass Directory Traversal Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

PHP 5 'posix_access()' Function 'safe_mode' Bypass Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references for more information.

Apple Mac OS X 10.5