Description
The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess.
References
- 2831 third-party-advisory
- http://www.php.net/ChangeLog-5.php#5.2.5
- 26822 third-party-advisory
- 28750 third-party-advisory
- ADV-2008-0059 vdb-entry
- php-sessionsavepath-errorlog-security-bypass(39403) vdb-entry
- GLSA-200710-02 vendor-advisory
- ADV-2008-0924 vdb-entry
- http://securityreason.com/achievement_exploitalert/9
- http://www.php.net/releases/4_4_8.php
- SSA:2008-045-03 vendor-advisory
- 30040 third-party-advisory
- ADV-2008-0398 vdb-entry
- http://www.php.net/releases/5_2_5.php
- http://www.php.net/ChangeLog-5.php#5.2.4
- 28936 third-party-advisory
- 2007-0026 vendor-advisory
- 29420 third-party-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- https://issues.rpath.com/browse/RPL-1693
- SSRT080056 vendor-advisory
- 3389 third-party-advisory
- 27648 third-party-advisory
- 20070627 PHP 5.2.3 PHP 4.4.7, htaccess safemode and open_basedir Bypass third-party-advisory
- https://issues.rpath.com/browse/RPL-1702
- 26838 third-party-advisory
- 27377 third-party-advisory
- 20070627 PHP 4/5 htaccess safemode and open_basedir Bypass mailing-list
- php-htaccess-security-bypass(35102) vdb-entry
- http://docs.info.apple.com/article.html?artnum=307562
- http://www.php.net/ChangeLog-4.php
- 27102 third-party-advisory
- ADV-2007-3023 vdb-entry
- http://www.php.net/releases/5_2_4.php
- SSRT080010 vendor-advisory
- 28318 third-party-advisory
- 25498 vdb-entry
- oval:org.mitre.oval:def:6056 vdb-entry signature
- 26642 third-party-advisory
- 24661 vdb-entry
- 38682 vdb-entry
- [oss-security] 20200917 Apache + PHP <= 7.4.10 open_basedir bypass mailing-list
- 20200918 Apache + PHP <= 7.4.10 open_basedir bypass mailing-list