PT-2006-5913 · Php · Php
Stefan Esser
·
Publicado
2006-10-06
·
Atualizado
2018-10-30
·
CVE-2006-5178
CVSS v2.0
6.2
Média
| Vetor | AV:L/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.1.6
Description
A race condition exists in the symlink function, allowing local users to bypass the open basedir restriction. This can be achieved by using a combination of symlink, mkdir, and unlink functions to change the file path after the open basedir check and before the file is opened by the underlying system. For example, an attacker can symlink a symlink into a subdirectory to point to a parent directory via .. (dot dot) sequences and then unlink the resulting symlink.
Recommendations
For PHP versions prior to 5.1.6, consider upgrading to a version that is not affected by this issue. As a temporary workaround, consider restricting the use of the symlink function to minimize the risk of exploitation. Additionally, ensure that the open basedir restriction is properly configured to limit the directories that can be accessed by PHP scripts.
Exploit
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Php