PHP ini_restore() safe_mode restrictions bypass
| php-inirestore-security-bypass (28853) |  Medium Risk |
Description:
PHP could allow a local attacker to bypass security options and modify configuration settings. By using the ini_restore() function, a local attacker could bypass options set by http.conf and reset configuration options in a php.ini file.
Platforms Affected:
- Canonical, Ubuntu 5.04
- Canonical, Ubuntu 5.10
- Canonical, Ubuntu 6.06 LTS
- HP, Internet Express 6.6
- HP, Secure Web Server for Tru64 6.6.4
- MandrakeSoft, Mandrake Linux 2006
- MandrakeSoft, Mandrake Linux 2006 X86_64
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft, Mandrake Multi Network Firewall 2.0
- Novell, Linux POS 9
- Novell, Open Enterprise Server
- Novell, Open Enterprise Server
- Novell, UnitedLinux 1.0
- OpenPKG, OpenPKG 2-STABLE
- OpenPKG, OpenPKG CURRENT
- OpenPKG, OpenPKG Enterprise E1.0-SOLID
- PHP, PHP 4.0 RC1
- PHP, PHP 4.0 Beta4
- PHP, PHP 4.0 Beta3
- PHP, PHP 4.0 Beta2
- PHP, PHP 4.0 Beta1
- PHP, PHP 4.0 Beta 4 Patch1
- PHP, PHP 4.0 RC2
- PHP, PHP 4.0.0
- PHP, PHP 4.0.1
- PHP, PHP 4.0.2
- PHP, PHP 4.0.3
- PHP, PHP 4.0.4
- PHP, PHP 4.0.5
- PHP, PHP 4.0.6
- PHP, PHP 4.0.7
- PHP, PHP 4.1.0
- PHP, PHP 4.1.1
- PHP, PHP 4.1.2
- PHP, PHP 4.1.3
- PHP, PHP 4.2.0
- PHP, PHP 4.2.1
- PHP, PHP 4.2.2
- PHP, PHP 4.2.3
- PHP, PHP 4.2.4
- PHP, PHP 4.3.0
- PHP, PHP 4.3.1
- PHP, PHP 4.3.10
- PHP, PHP 4.3.11
- PHP, PHP 4.3.2
- PHP, PHP 4.3.3
- PHP, PHP 4.3.4
- PHP, PHP 4.3.5
- PHP, PHP 4.3.6
- PHP, PHP 4.3.7
- PHP, PHP 4.3.8
- PHP, PHP 4.3.9
- PHP, PHP 4.4.0
- PHP, PHP 4.4.1
- PHP, PHP 4.4.2
- PHP, PHP 4.4.3
- PHP, PHP 4.4.4
- PHP, PHP 5.1.6
- SuSE, Linux Enterprise Server 8
- SuSE, SLE SDK 10
- SuSE, SuSE Linux 10.0
- SuSE, SuSE Linux 10.1
- SuSE, SuSE Linux 9.2
- SuSE, SuSE Linux 9.3
- SuSE, SuSE Linux OpenExchange Server 4
- SuSE, SuSE Linux Retail Solution 8
- SuSE, SuSE Linux School Server
- SuSE, SuSE Linux Standard Server 8
- SuSE, SuSE SLES 10
- SuSE, SuSE SLES 9
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 10 Server x64 Ed
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux Home
- Turbolinux, Turbolinux Multimedia
- Turbolinux, Turbolinux Personal
- Turbolinux, Turbolinux
- Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
- Turbolinux, Turbolinux Appliance Server 2.0
Remedy:
Upgrade to the latest CVS release of PHP, available from The PHP Group Web site. See References.
For Hewlett-Packard (PHP):
Refer to HPSBTU02232 SSRT071429 for patch, upgrade, or suggested workaround information. See References.
For Turbolinux:
Refer to Turbolinux Security Advisory TLSA-2006-38 for patch, upgrade, or suggested workaround information. See References.
For SUSE Linux:
Refer to SUSE-SA:2006:059 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Bypass Security
References:
- Full-Disclosure Mailing List, Sat Sep 09 2006 - 05:30:16 CDT, PHP 5.1.6 / 4.4.4 Critical php_admin* bypass by ini_restore() at http://archives.neohapsis.com/archives/fulldisclosure/2006-09/0149.html.
- HPSBTU02232 SSRT071429 , Secure Web Server for HP Tru64 UNIX Powered by Apache (SWS) or HP Internet Express for Tru64 UNIX running PHP, Remote Arbitrary Code Execution, Unauthorized Disclosure of Information, or Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137&jumpid=reg_R1002_USEN.
- The PHP Group Web site, PHP: Downloads at http://www.php.net/downloads.php#v5.
- BID-19933: PHP Ini_Restore() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
- CVE-2006-4625: PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
- MDKSA-2006:185: Updated php packages to address multiple vulnerabilities
- OpenPKG-SA-2006.023: PHP
- SA22282: PHP "ini_restore()" Security Bypass Vulnerability
- SA25423: HP System Management Homepage PHP Multiple Vulnerabilities
- SA25850: HP Secure Web Server/Internet Express for Tru64 UNIX PHP Vulnerabilities
- SUSE-SA:2006:059: PHP security problems
Reported:
Sep 09, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net