PHP chdir and ftoc() security bypass

php-chdir-ftoc-security-bypass (43198) The risk level is classified as MediumMedium Risk

Description:

PHP could allow a remote attacker to bypass security restrictions, caused by an error in the chdir() and ftoc() and possibly other functions. A remote attacker could exploit this vulnerability using a specially-crafted PHP script to bypass safe mode restrictions on a shared-server environment to access arbitrary files outside of the Web root and possibly launch further attacks against the system.

Platforms Affected:

  • Apple, Mac OS X 10.5
  • Apple, Mac OS X 10.5.1
  • Apple, Mac OS X 10.5.2
  • Apple, Mac OS X 10.5.3
  • Apple, Mac OS X 10.5.4
  • Apple, Mac OS X 10.5.5
  • Apple, Mac OS X 10.5.6
  • Apple, Mac OS X Server 10.5
  • Apple, Mac OS X Server 10.5.1
  • Apple, Mac OS X Server 10.5.2
  • Apple, Mac OS X Server 10.5.3
  • Apple, Mac OS X Server 10.5.4
  • Apple, Mac OS X Server 10.5.5
  • Apple, Mac OS X Server 10.5.6
  • Gentoo, Linux
  • PHP, PHP 5.2.6

Remedy:

For Apple Mac OS:
Apply Apple Security Update 2009-002, available from the Apple Web site. See References.

Upgrade to the latest version of PHP (5.2.7 or later), available from the PHP Web site. See References.

Consequences:

Bypass Security

References:

  • Apple Web site, About the security content of Security Update 2009-002 / Mac OS X v10.5.7 at http://support.apple.com/kb/HT3549.
  • PHP Web site, PHP: Hypertext Preprocessor at http://www.php.net/.
  • PHP Web site, PHP 5 ChangeLog, Version 5.2.7 at http://www.php.net/ChangeLog-5.php#5.2.8.
  • SecurityReason Advisory: SecurityAlert : 55, PHP 5.2.6 chdir(),ftok() (standard ext) safe_mode bypass at http://securityreason.com/achievement_securityalert/55.
  • ASA-2009-255: HPSBUX02431 SSRT090085 rev.1 - HP-UX Running Apache Web Server SuiteRemote Denial of Service (DoS) Execution of Arbitrary Code
  • BID-29796: PHP 'chdir()' and 'ftok()' 'safe_mode' Multiple Security Bypass Vulnerabilities
  • CVE-2008-2666: Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.
  • GLSA-200811-05: PHP: Multiple vulnerabilities
  • SECTRACK ID: 1020328: PHP File and Directory Function safe_mode Restrictions Can By Bypass With 'http://' Prefix

Reported:

Jun 17, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page