int(2983)

Vulnerability Bulletins

Salto de restricciones en PHP

Vulnerability classification
Property Value
Confidence level Oficial
Impact Aumento de la visibilidad
Dificulty Experto
Required attacker level Acceso remoto con cuenta

System information
Property Value
Affected manufacturer GNU/Linux
Affected software PHP 5.2.0
PHP 4.4

Description
Se ha descubierto una vulnerabilidad en PHP 5.2.0 y en la versión 4.4. La vulnerabilidad reside en un error al validar el argumento session_save_path.

Un atacante local podría saltarse las restricciones safe_mode y open_basedir mediante un path especialmente construido con un byte nulo antes de ";" en el argumento session_save_path seguido de un path permitido, esto causaría una inconsistencia en el parseo del parámetro pero establecería la variable session.save_path con el path malicioso.

Solution


Actualización de software

Mandriva (MDKSA-2007:038)

Corporate Server 3.0
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/i586/libphp_common432-4.3.4-4.23.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/i586/php-cgi-4.3.4-4.23.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/i586/php-cli-4.3.4-4.23.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/i586/php-gd-4.3.4-1.5.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/i586/php432-devel-4.3.4-4.23.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/php-4.3.4-4.23.C30mdk.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/php-gd-4.3.4-1.5.C30mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/x86_64/lib64php_common432-4.3.4-4.23.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/x86_64/php-cgi-4.3.4-4.23.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/x86_64/php-cli-4.3.4-4.23.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/x86_64/php-gd-4.3.4-1.5.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/x86_64/php432-devel-4.3.4-4.23.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/php-4.3.4-4.23.C30mdk.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/php-gd-4.3.4-1.5.C30mdk.src.rpm

Multi Network Firewall 2.0
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/i586/libphp_common432-4.3.4-4.23.M20mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/i586/php-cgi-4.3.4-4.23.M20mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/i586/php-cli-4.3.4-4.23.M20mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/i586/php-gd-4.3.4-1.5.M20mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/i586/php432-devel-4.3.4-4.23.M20mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/SRPMS/php-4.3.4-4.23.M20mdk.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/mnf/2.0/SRPMS/php-gd-4.3.4-1.5.M20mdk.src.rpm

Mandriva Linux 2006
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/libphp5_common5-5.0.4-9.18.20060mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/php-cgi-5.0.4-9.18.20060mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/php-cli-5.0.4-9.18.20060mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/php-devel-5.0.4-9.18.20060mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/php-fcgi-5.0.4-9.18.20060mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/php-gd-5.0.4-2.1.20060mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/php-5.0.4-9.18.20060mdk.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/php-gd-5.0.4-2.1.20060mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/lib64php5_common5-5.0.4-9.18.20060mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/php-cgi-5.0.4-9.18.20060mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/php-cli-5.0.4-9.18.20060mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/php-devel-5.0.4-9.18.20060mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/php-fcgi-5.0.4-9.18.20060mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/php-gd-5.0.4-2.1.20060mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/php-5.0.4-9.18.20060mdk.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/php-gd-5.0.4-2.1.20060mdk.src.rpm

Mandriva Linux 2007
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/libphp5_common5-5.1.6-1.4mdv2007.0.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/php-cgi-5.1.6-1.4mdv2007.0.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/php-cli-5.1.6-1.4mdv2007.0.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/php-devel-5.1.6-1.4mdv2007.0.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/php-fcgi-5.1.6-1.4mdv2007.0.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/php-gd-5.1.6-1.1mdv2007.0.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/SRPMS/php-5.1.6-1.4mdv2007.0.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/SRPMS/php-gd-5.1.6-1.1mdv2007.0.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/lib64php5_common5-5.1.6-1.4mdv2007.0.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/php-cgi-5.1.6-1.4mdv2007.0.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/php-cli-5.1.6-1.4mdv2007.0.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/php-devel-5.1.6-1.4mdv2007.0.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/php-fcgi-5.1.6-1.4mdv2007.0.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/php-gd-5.1.6-1.1mdv2007.0.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/SRPMS/php-5.1.6-1.4mdv2007.0.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/SRPMS/php-gd-5.1.6-1.1mdv2007.0.src.rpm

Corporate Server 4.0
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/libphp4_common4-4.4.4-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/libphp5_common5-5.1.6-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/php-cgi-5.1.6-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/php-cli-5.1.6-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/php-devel-5.1.6-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/php-fcgi-5.1.6-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/php-gd-5.1.6-1.1.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/php4-cgi-4.4.4-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/php4-cli-4.4.4-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/php4-devel-4.4.4-1.3.20060mlcs4.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/SRPMS/php-5.1.6-1.3.20060mlcs4.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/SRPMS/php-gd-5.1.6-1.1.20060mlcs4.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/SRPMS/php4-4.4.4-1.3.20060mlcs4.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/lib64php5_common5-5.1.6-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/php-cgi-5.1.6-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/php-cli-5.1.6-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/php-devel-5.1.6-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/php-fcgi-5.1.6-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/php-gd-5.1.6-1.1.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/php4-cgi-4.4.4-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/php4-cli-4.4.4-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/php4-devel-4.4.4-1.3.20060mlcs4.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/SRPMS/php-5.1.6-1.3.20060mlcs4.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/SRPMS/php-gd-5.1.6-1.1.20060mlcs4.src.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/SRPMS/php4-4.4.4-1.3.20060mlcs4.src.rpm

Standar resources
Property Value
CVE CVE-2006-6383
BID 21508

Other resources
Mandriva Security Advisory (MDKSA-2007:038)
http://www.mandriva.com/security/advisories?name=MDKSA-2007:038

Version history
Version Comments Date
1.0 Aviso emitido 2007-02-07
Ministerio de Defensa
CNI
CCN
CCN-CERT