PHP tempnam() unique file name restrictions bypass
| php-tempnam-bypass (27049) |  Low Risk |
Description:
PHP could allow a local attacker to bypass unique file name restrictions, caused by improper validation of user-supplied input by the tempnam() function. An attacker could exploit this vulnerability using an overly long file path in an argument to the tempnam(), which could allow the attacker to bypass file name restrictions and perform unspecified malicious activity on an affected system.
Consequences:
Bypass Security
Remedy:
Upgrade to the latest PHP_5_2 branch or PHP_4_4 branch from the PHP CVS Repository. See References.
References:
- Full-Disclosure Mailing List, Sun Jun 11 2006 - 17:40:40 CDT : tempnam() Bypass unique file name PHP 5.1.4.
- [cvs] View of /php-src/NEWS - Tue May 23 23:22:04 2006 UTC - Branch: PHP_5_2: Fixed handling of extremely long paths inside tempnam() function..
- [cvs] View of /php-src/NEWS - Tue May 23 23:23:40 2006 UTC - Branch: PHP_4_4: Fixed handling of extremely long paths inside tempnam() function..
- CVE-2006-2660: Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.
- MDKSA-2006:122: Updated php packages fix multiple vulnerabilities
- SECTRACK ID: 1016271: PHP tempnam() Function Can Be Bypassed
- USN-320-1: PHP vulnerabilities
- USN-320-2: PHP regression
Platforms Affected:
- Canonical Ubuntu 5.04
- Canonical Ubuntu 5.10
- Canonical Ubuntu 6.06 LTS
- MandrakeSoft Mandrake Linux 2006 X86_64
- MandrakeSoft Mandrake Linux 2006
- MandrakeSoft Mandrake Linux LE2005
- MandrakeSoft Mandrake Linux LE2005 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 3.0
- MandrakeSoft Mandrake Multi Network Firewall 2.0
- PHP PHP 4.0 RC1
- PHP PHP 4.0 RC2
- PHP PHP 4.0 Beta4
- PHP PHP 4.0 Beta3
- PHP PHP 4.0 Beta2
- PHP PHP 4.0 Beta1
- PHP PHP 4.0 Beta 4 Patch1
- PHP PHP 4.0.0
- PHP PHP 4.0.1
- PHP PHP 4.0.2
- PHP PHP 4.0.3
- PHP PHP 4.0.4
- PHP PHP 4.0.5
- PHP PHP 4.0.6
- PHP PHP 4.0.7
- PHP PHP 4.1.0
- PHP PHP 4.1.1
- PHP PHP 4.1.2
- PHP PHP 4.1.3
- PHP PHP 4.2.0
- PHP PHP 4.2.1
- PHP PHP 4.2.2
- PHP PHP 4.2.3
- PHP PHP 4.2.4
- PHP PHP 4.3.0
- PHP PHP 4.3.1
- PHP PHP 4.3.10
- PHP PHP 4.3.11
- PHP PHP 4.3.2
- PHP PHP 4.3.3
- PHP PHP 4.3.4
- PHP PHP 4.3.5
- PHP PHP 4.3.6
- PHP PHP 4.3.7
- PHP PHP 4.3.8
- PHP PHP 4.3.9
- PHP PHP 4.4.0
- PHP PHP 4.4.1
- PHP PHP 4.4.2
- PHP PHP 5.0.0 RC3
- PHP PHP 5.0.0 RC2
- PHP PHP 5.0.0 RC1
- PHP PHP 5.0.0 Beta4
- PHP PHP 5.0.0 Beta3
- PHP PHP 5.0.0 Beta2
- PHP PHP 5.0.0 Beta1
- PHP PHP 5.0.0
- PHP PHP 5.0.1
- PHP PHP 5.0.2
- PHP PHP 5.0.3
- PHP PHP 5.0.4
- PHP PHP 5.0.5
- PHP PHP 5.1.0
- PHP PHP 5.1.1
- PHP PHP 5.1.2
- PHP PHP 5.1.3
- PHP PHP 5.1.4
Reported:
Jun 11, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net