PHP '/tmp/phpglibccheck' Symlink Vulnerability
BID:67837
Info
PHP '/tmp/phpglibccheck' Symlink Vulnerability
| Bugtraq ID: | 67837 |
| Class: | Race Condition Error |
| CVE: |
CVE-2014-3981 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 04 2014 12:00AM |
| Updated: | May 07 2015 05:33PM |
| Credit: | A B |
| Vulnerable: |
Slackware Slackware Linux 14.1 Slackware Slackware Linux 14.0 PHP PHP 5.5.13 PHP PHP 5.2.17.03 IBM QRadar Incident Forensics 7.2 MR2 IBM Lotus Protector for Mail Security 2.8 0 IBM Lotus Protector for Mail Security 2.8.1.0 HP HP-UX Web Server Suite 3.29 HP HP-UX B.11.31 HP HP-UX B.11.23 Gentoo Linux Apple Mac OS X 10.9.5 Apple Mac OS X 10.9.1 Apple Mac OS X 10.8.5 Apple Mac OS X 10.9.4 Apple Mac OS X 10.9.4 Apple Mac OS X 10.9.3 Apple Mac OS X 10.9.2 Apple Mac OS X 10.9 Apple Mac OS X 10.10.2 Apple Mac OS X 10.10.1 Apple Mac OS X 10.10 Apache Tomcat 5.5.36.01 |
| Not Vulnerable: |
IBM QRadar Incident Forensics 7.2 MR3 Apple Mac OS X 10.9.5 Apple Mac Os X 10.10.3 |
Discussion
PHP '/tmp/phpglibccheck' Symlink Vulnerability
PHP is prone to a symlink vulnerability.
Successfully exploiting these issues may allow an attacker to manipulate files on host system through symlink attacks.
PHP 5.5.13 is vulnerable; other versions may also affected.
PHP is prone to a symlink vulnerability.
Successfully exploiting these issues may allow an attacker to manipulate files on host system through symlink attacks.
PHP 5.5.13 is vulnerable; other versions may also affected.
Exploit / POC
PHP '/tmp/phpglibccheck' Symlink Vulnerability
An attacker uses readily available commands to exploit the issue.
An attacker uses readily available commands to exploit the issue.
Solution / Fix
PHP '/tmp/phpglibccheck' Symlink Vulnerability
Solution:
Currently we are not aware of any vendor supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
References
PHP '/tmp/phpglibccheck' Symlink Vulnerability
References:
References:
- Bug 1104978 - php: insecure temporary file use in the configure script (Red Hat Bugzilla)
- PHP Homepage (PHP)
- HPSBUX03102 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat o (HP)
- HPSBUX03150 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat o (HP)
- Security Bulletin: Multiple vulnerabilities in PHP 5.2 open source component for (IBM)
- Security Bulletin: Multiple vulnerabilities in PHP as used by IBM QRadar Inciden (IBM)