PHP CVE-2012-3365 'open_basedir' Security-Bypass Vulnerability

Bugtraq ID:	54612
Class:	Design Error
CVE:	CVE-2012-3365
Remote:	Yes
Local:	Yes
Published:	Jul 20 2012 12:00AM
Updated:	Apr 08 2014 01:07AM
Credit:	Reported by the vendor
Vulnerable:	SuSE SUSE Linux Enterprise Server for VMware 11 SP2 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server for VMware 11 SP1 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 11 SP2 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 11 SP1 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 10 SP4 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 10 SP3 LTSS + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise SDK 11 SP2 SuSE SUSE Linux Enterprise SDK 11 SP1 SuSE SUSE Linux Enterprise SDK 10 SP4 PHP PHP 5.3.13 PHP PHP 5.3.12 PHP PHP 5.3.9 PHP PHP 5.3.8 PHP PHP 5.3.7 PHP PHP 5.3.6 PHP PHP 5.3.6 PHP PHP 5.3.5 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.3.5 PHP PHP 5.3.4 PHP PHP 5.3.3 PHP PHP 5.3.11 PHP PHP 5.3.10 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Collax Collax Business Server 5.5.2 Collax Collax Business Server 5.5
Not Vulnerable:

PHP CVE-2012-3365 'open_basedir' Security-Bypass Vulnerability

PHP is prone to a security-bypass vulnerability.

Successful exploits will allow attackers to bypass certain security restrictions.

Versions prior to PHP 5.3.15 are vulnerable.

PHP CVE-2012-3365 'open_basedir' Security-Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP CVE-2012-3365 'open_basedir' Security-Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

PHP CVE-2012-3365 'open_basedir' Security-Bypass Vulnerability

References:

• Collax Business Server Homepage (collax)
  
• PHP Homepage (PHP)