PHP Undefined Safe_Mode_Include_Dir Safemode Bypass Vulnerability
BID:8201
Info
PHP Undefined Safe_Mode_Include_Dir Safemode Bypass Vulnerability
| Bugtraq ID: | 8201 |
| Class: | Design Error |
| CVE: |
CVE-2003-0863 |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 16 2003 12:00AM |
| Updated: | Jul 11 2009 10:56PM |
| Credit: | Discovery of this issue is credited to Michal Krause <[email protected]>. |
| Vulnerable: |
PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.1.5 Apple Mac OS X Server 10.1.4 Apple Mac OS X Server 10.1.3 Apple Mac OS X Server 10.1.2 Apple Mac OS X Server 10.1.1 Apple Mac OS X Server 10.1 Apple Mac OS X Server 10.0 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 3 Apple Mac OS X 10.0 |
| Not Vulnerable: |
Apple Mac OS X Server 10.3.8 Apple Mac OS X 10.3.8 |
Discussion
PHP Undefined Safe_Mode_Include_Dir Safemode Bypass Vulnerability
PHP is prone to an issue that may allow programs to bypass Safe Mode by calling external files in restricted directories using include() and require().
The problem is known to occur when the safe_mode_include_dir PHP directive is not defined. A logic error reportedly exists which could result in PHP failing to run a security check when attempting to access a file via an include() or require() call, potentially bypassing the Safe Mode model. This could allow unauthorized access or policy bypass in environments that use Safe Mode, such as in cases where a web server resource is shared by multiple users.
This issue is reported to exist in PHP versions 4.3.0 and later.
PHP is prone to an issue that may allow programs to bypass Safe Mode by calling external files in restricted directories using include() and require().
The problem is known to occur when the safe_mode_include_dir PHP directive is not defined. A logic error reportedly exists which could result in PHP failing to run a security check when attempting to access a file via an include() or require() call, potentially bypassing the Safe Mode model. This could allow unauthorized access or policy bypass in environments that use Safe Mode, such as in cases where a web server resource is shared by multiple users.
This issue is reported to exist in PHP versions 4.3.0 and later.
Solution / Fix
PHP Undefined Safe_Mode_Include_Dir Safemode Bypass Vulnerability
Solution:
This issue reportedly does not exist in PHP versions prior to 4.3.0. Though this has not been confirmed by Symantec.
Apple Computers has released advisory APPLE-SA-2005-01-25 along with a security update dealing with this and other issues. Please see the referenced advisory for more information.
Apple Computers has released Mac OS X version 10.3.8 dealing with this issue. This upgrade includes the security patches shipped with the referenced security update.
Apple Mac OS X 10.2.8
Apple Mac OS X Server 10.2.8
Apple Mac OS X Server 10.3.7
Apple Mac OS X 10.3.7
Solution:
This issue reportedly does not exist in PHP versions prior to 4.3.0. Though this has not been confirmed by Symantec.
Apple Computers has released advisory APPLE-SA-2005-01-25 along with a security update dealing with this and other issues. Please see the referenced advisory for more information.
Apple Computers has released Mac OS X version 10.3.8 dealing with this issue. This upgrade includes the security patches shipped with the referenced security update.
Apple Mac OS X 10.2.8
-
Apple Security Update 2005-001 (Mac OS X 10.2.8 Client) 1.0
http://www.apple.com/support/downloads/securityupdate2005001macosx1028 client.html
Apple Mac OS X Server 10.2.8
-
Apple Security Update 2005-001 (Mac OS X 10.2.8 Server) 1.0
http://www.apple.com/support/downloads/securityupdate2005001macosx1028 server.html
Apple Mac OS X Server 10.3.7
-
Apple Security Update 2005-001 (Mac OS X 10.3.7 Server) 1.0
http://www.apple.com/support/downloads/securityupdate2005001macosx1037 server.html -
Apple Mac OS X 10.3.8 upgrade
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05368&plat form=osx&method=sa/MacOSXUpdate10.3.8.dmg
Apple Mac OS X 10.3.7
-
Apple Security Update 2005-001 (Mac OS X 10.3.7 Client) 1.0
http://www.apple.com/support/downloads/securityupdate2005001macosx1037 client.html -
Apple Mac OS X 10.3.8 upgrade
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=05368&plat form=osx&method=sa/MacOSXUpdate10.3.8.dmg
References
PHP Undefined Safe_Mode_Include_Dir Safemode Bypass Vulnerability
References:
References:
- PHP safe mode broken? (Michal Krause
- Re: PHP safe mode broken? (Michal Krause