PHP 'mail.log' Configuration Option 'open_basedir' Restriction Bypass Vulnerability

Bugtraq ID:	36007
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 10 2009 12:00AM
Updated:	Aug 21 2009 03:56PM
Credit:	Maksymilian Arciemowicz
Vulnerable:	PHP PHP 5.3
Not Vulnerable:

PHP 'mail.log' Configuration Option 'open_basedir' Restriction Bypass Vulnerability

PHP is prone to an 'open_basedir' restriction-bypass vulnerability because of a design error.

Successful exploits could allow an attacker to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

PHP 5.3.0 is vulnerable.

PHP 'mail.log' Configuration Option 'open_basedir' Restriction Bypass Vulnerability

Attackers may exploit these issues by crafting and executing standard PHP code.

The following proof of concept is available:

• /data/vulnerabilities/exploits/36007.php

PHP 'mail.log' Configuration Option 'open_basedir' Restriction Bypass Vulnerability

Solution:
Updates are available in the CVS repository; please see the references for more information.

PHP 'mail.log' Configuration Option 'open_basedir' Restriction Bypass Vulnerability

References:

• [svn] Revision 283734 (stas)
  
• PHP 5.3.0 (main.c) open_basedir bypass (Maksymilian Arciemowicz)
  
• PHP Homepage (PHP Group)