Description
fopen_wrappers.c in PHP 4.4.0, and possibly other versions, does not properly restrict access to other directories when the open_basedir directive includes a trailing slash, which allows PHP scripts in one directory to access files in other directories whose names are substrings of the original directory.
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323585
- MDKSA-2005:213 vendor-advisory
- TSLSA-2005-0059 vendor-advisory
- ADV-2005-1862 vdb-entry
- ADV-2005-2254 vdb-entry
- USN-207-1 vendor-advisory
- 14957 vdb-entry
- 17371 third-party-advisory
- http://www.php.net/release_4_4_1.php
- 17510 third-party-advisory
- 17557 third-party-advisory
- 17229 third-party-advisory
- GLSA-200511-08 vendor-advisory