FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-5178

This CVE name corresponds to:

Entered	Topic
2006-10-05	php -- open_basedir Race Condition Vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-5178 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-5178
Phase	Assigned(20061005)

Description

Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink.

References

Source	Reference
BUGTRAQ	20061003 Advisory 08/2006: PHP open_basedir Race Condition Vulnerability
BUGTRAQ	20061009 PHP open_basedir with symlink() function Race Condition PoC exploit
FULLDISC	20061003 Advisory 08/2006: PHP open_basedir Race Condition Vulnerability
MISC	http://www.hardened-php.net/advisory_082006.132.html
MISC	http://www.neosecurityteam.net/index.php?action=advisories&id=26
MANDRIVA	MDKSA-2006:185
OPENPKG	OpenPKG-SA-2006.023
TURBO	TLSA-2006-38
BID	20326
VUPEN	ADV-2006-3901
SECTRACK	1016977
SECUNIA	22235
SECUNIA	22424
SREASON	1692
XF	php-openbasedir-security-bypass(29340)