Description
PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "php_value error_log" entry in a .htaccess file.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 5.2.6 - 'error_log' Safe_mode Bypass EDB-7171 · local · Nov 20, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- HPSBUX02465 vendor-advisory
- SSRT090085 vendor-advisory
- 20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl mailing-list
- http://wiki.rpath.com/Advisories:rPSA-2009-0035
- php-error-safemode-bypass(47314) vdb-entry
- 32383 vdb-entry
- 20081120 PHP 5.2.6 (error_log) safe_mode bypass third-party-advisory
- 52205 vdb-entry
- http://www.php.net/ChangeLog-5.php#5.2.7
- MDVSA-2009:045 vendor-advisory
- 20081120 SecurityReason : PHP 5.2.6 (error_log) safe_mode bypass mailing-list
- 7171 exploit
- 35650 third-party-advisory