PHP 'symlink()' 'open_basedir' Restriction Bypass Vulnerability

Bugtraq ID:	37032
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 13 2009 12:00AM
Updated:	Mar 19 2015 08:39AM
Credit:	Maksymilian Arciemowicz
Vulnerable:	PHP PHP 5.3.9 PHP PHP 5.3.8 PHP PHP 5.3.7 PHP PHP 5.3.6 PHP PHP 5.3.5 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.2.12 PHP PHP 5.2.11 PHP PHP 5.3.5 PHP PHP 5.3.4 RC1 PHP PHP 5.3.4 PHP PHP 5.3.3 PHP PHP 5.3.10
Not Vulnerable:

PHP 'symlink()' 'open_basedir' Restriction Bypass Vulnerability

PHP is prone to an 'open_basedir' restriction-bypass vulnerability because of a design error.

Successful exploits could allow an attacker to read and write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code. In such cases, 'open_basedir' restrictions are expected to isolate users from each other.

PHP 5.2.11 and 5.3.0 are vulnerable; other versions may also be affected.

PHP 'symlink()' 'open_basedir' Restriction Bypass Vulnerability

Attackers may exploit these issues by crafting and executing standard PHP code.

The following exploits are available:

• /data/vulnerabilities/exploits/37032.php
• /data/vulnerabilities/exploits/37032-2.php

PHP 'symlink()' 'open_basedir' Restriction Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP 'symlink()' 'open_basedir' Restriction Bypass Vulnerability

References:

• PHP 5.2.11/5.3.0 Multiple Vulnerabilities (Maksymilian Arciemowicz)
  
• PHP 5.2.11/5.3.0 symlink() open_basedir bypass (Maksymilian Arciemowicz)
  
• PHP 5.4/5.3 deprecated eregi() memory_limit bypass (Maksymilian Arciemowicz)
  
• PHP Homepage (PHP Group)