Description
Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 5.2.6 - 'chdir()' Function http URL Argument Safe_mode Restriction Bypass EDB-31937 · local · Jun 18, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 32746 third-party-advisory
- HPSBUX02465 vendor-advisory
- http://support.apple.com/kb/HT3549
- 3942 third-party-advisory
- GLSA-200811-05 vendor-advisory
- SSRT090085 vendor-advisory
- 20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl mailing-list
- http://wiki.rpath.com/Advisories:rPSA-2009-0035
- 29796 vdb-entry
- 35074 third-party-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- php-chdir-ftoc-security-bypass(43198) vdb-entry
- TA09-133A third-party-advisory
- ADV-2009-1297 vdb-entry
- 1020328 vdb-entry
- 35650 third-party-advisory
- 20080617 PHP 5.2.6 chdir(),ftok() (standard ext) safe_mode bypass third-party-advisory