PHP 'tempnam()' Function 'MAXPATHLEN' Restriction Security Bypass Vulnerability
BID:49634
Info
PHP 'tempnam()' Function 'MAXPATHLEN' Restriction Security Bypass Vulnerability
| Bugtraq ID: | 49634 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-2660 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 11 2006 12:00AM |
| Updated: | Jun 11 2006 12:00AM |
| Credit: | Maksymilian Arciemowicz from SecurityReason |
| Vulnerable: |
PHP PHP 5.1.4 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 .0 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 |
| Not Vulnerable: |
PHP PHP 4.4.3 PHP PHP 5.2 |
Discussion
PHP 'tempnam()' Function 'MAXPATHLEN' Restriction Security Bypass Vulnerability
PHP is prone to a security-bypass vulnerability.
Successful exploits could allow an attacker to bypass restrictions and create arbitrary PHP files with fixed file names in any writable directory.
This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code.
PHP 5.1.4 and 4.x prior to 4.4.3 are vulnerable; other versions may also be affected.
PHP is prone to a security-bypass vulnerability.
Successful exploits could allow an attacker to bypass restrictions and create arbitrary PHP files with fixed file names in any writable directory.
This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code.
PHP 5.1.4 and 4.x prior to 4.4.3 are vulnerable; other versions may also be affected.
Exploit / POC
PHP 'tempnam()' Function 'MAXPATHLEN' Restriction Security Bypass Vulnerability
To exploit this issue, an attacker can use readily available tools.
To exploit this issue, an attacker can use readily available tools.
Solution / Fix
PHP 'tempnam()' Function 'MAXPATHLEN' Restriction Security Bypass Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
PHP 'tempnam()' Function 'MAXPATHLEN' Restriction Security Bypass Vulnerability
References:
References:
- tempnam() Bypass unique file name PHP 5.1.4 (SecurityReason)
- PHP Homepage (PHP)
- tempnam() Bypass unique file name PHP 5.1.4 (Maksymilian Arciemowicz)