PT-2006-5913 · Php · Php
Stefan Esser
·
Published
2006-10-06
·
Updated
2018-10-30
·
CVE-2006-5178
CVSS v2.0
6.2
Medium
| Vector | AV:L/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.1.6
Description
A race condition exists in the symlink function, allowing local users to bypass the open basedir restriction. This can be achieved by using a combination of symlink, mkdir, and unlink functions to change the file path after the open basedir check and before the file is opened by the underlying system. For example, an attacker can symlink a symlink into a subdirectory to point to a parent directory via .. (dot dot) sequences and then unlink the resulting symlink.
Recommendations
For PHP versions prior to 5.1.6, consider upgrading to a version that is not affected by this issue. As a temporary workaround, consider restricting the use of the symlink function to minimize the risk of exploitation. Additionally, ensure that the open basedir restriction is properly configured to limit the directories that can be accessed by PHP scripts.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Php