exploits , vulnerabilities , articles , PHP Ini_Restore() Safe_Mode and Open

Title	PHP Ini_Restore() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
Published	2006-09-09-12:00AM
Updated	2006-09-09-12:00AM
Class	Input Validation Error
CVE	CVE-2006-4625
Remote	No
Local	Yes
Credit	Maksymilian Arciemowicz discovered this issue.
Vulnerable	PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 Trustix Secure Linux 2.2 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 5.0 .0 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 Gentoo Linux RedHat Fedora Core3 Trustix Secure Enterprise Linux 2.0 Trustix Secure Linux 2.2 Trustix Secure Linux 2.1 Trustix Secure Linux 2.0 Trustix Secure Linux 1.5 PHP PHP 4.3.9 PHP PHP 4.3.8 MandrakeSoft Linux Mandrake 10.1 x86_64 MandrakeSoft Linux Mandrake 10.1 S.u.S.E. Linux Personal 9.2 Turbolinux Turbolinux Server 10.0 Ubuntu Ubuntu Linux 4.1 ppc Ubuntu Ubuntu Linux 4.1 ia64 Ubuntu Ubuntu Linux 4.1 ia32 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Linux Mandrake 10.0 AMD64 MandrakeSoft Linux Mandrake 10.0 S.u.S.E. Linux Personal 9.1 PHP PHP 4.3.3 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 Turbolinux Home Turbolinux Turbolinux 10 F... Turbolinux Turbolinux Desktop 10.0 PHP PHP 4.3.2 PHP PHP 4.3.1 MandrakeSoft Linux Mandrake 9.1 ppc MandrakeSoft Linux Mandrake 9.1 OpenPKG OpenPKG Current S.u.S.E. Linux Personal 8.2 PHP PHP 4.3 PHP PHP 4.2.3 EnGarde Secure Linux 1.0.1 MandrakeSoft Corporate Server 2.1 x86_64 MandrakeSoft Corporate Server 2.1 MandrakeSoft Linux Mandrake 9.0 Turbolinux Turbolinux Server 8.0 Turbolinux Turbolinux Server 7.0 Turbolinux Turbolinux Workstation 8.0 Turbolinux Turbolinux Workstation 7.0 PHP PHP 4.2.2 Gentoo Linux 1.4 _rc1 Gentoo Linux 1.2 OpenPKG OpenPKG 1.1 RedHat Linux 8.0 i386 RedHat Linux 8.0 S.u.S.E. Linux 8.1 PHP PHP 4.2.1 FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 Slackware Linux 8.1 PHP PHP 4.2 .0 PHP PHP 4.2 dev PHP PHP 4.1.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia64 Debian Linux 3.0 ia32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha MandrakeSoft Linux Mandrake 8.2 ppc MandrakeSoft Linux Mandrake 8.2 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Single Network Firewall 7.2 PHP PHP 4.1.1 Conectiva Linux 7.0 PHP PHP 4.1 .0 S.u.S.E. Linux 8.0 i386 S.u.S.E. Linux 8.0 PHP PHP 4.0.7 RC3 PHP PHP 4.0.7 RC2 PHP PHP 4.0.7 RC1 PHP PHP 4.0.7 PHP PHP 4.0.6 Caldera OpenLinux Server 3.1.1 Caldera OpenLinux Server 3.1 Caldera OpenLinux Workstation 3.1.1 Caldera OpenLinux Workstation 3.1 HP Secure OS software for Linux 1.0 IBM AIX 4.3.3 IBM AIX 4.3.2 IBM AIX 4.3.1 IBM AIX 4.3 IBM AIX 5.1 MandrakeSoft Corporate Server 1.0.1 MandrakeSoft Linux Mandrake 8.1 ia64 MandrakeSoft Linux Mandrake 8.1 MandrakeSoft Linux Mandrake 8.0 ppc MandrakeSoft Linux Mandrake 8.0 MandrakeSoft Linux Mandrake 7.2 MandrakeSoft Linux Mandrake 7.1 RedHat Linux 7.2 ia64 RedHat Linux 7.2 i386 RedHat Linux 7.2 RedHat Linux 7.1 ia64 RedHat Linux 7.1 i386 RedHat Linux 7.1 alpha RedHat Linux 7.1 RedHat Linux 7.0 i386 RedHat Linux 7.0 alpha RedHat Linux 7.0 S.u.S.E. Linux 7.3 sparc S.u.S.E. Linux 7.3 ppc S.u.S.E. Linux 7.3 i386 S.u.S.E. Linux 7.3 S.u.S.E. Linux 7.2 i386 S.u.S.E. Linux 7.2 Sun Cobalt RaQ 550 Sun LX50 Trustix Secure Linux 1.5 PHP PHP 4.0.5 PHP PHP 4.0.4 Compaq Compaq Secure Web Server PHP 1.0 Conectiva Linux 6.0 Guardian Digital Engarde Secure Linux 1.0.1 S.u.S.E. Linux 7.2 S.u.S.E. Linux 7.1 x86 S.u.S.E. Linux 7.1 sparc S.u.S.E. Linux 7.1 ppc S.u.S.E. Linux 7.1 alpha S.u.S.E. Linux 7.1 S.u.S.E. Linux 7.0 sparc S.u.S.E. Linux 7.0 ppc S.u.S.E. Linux 7.0 i386 S.u.S.E. Linux 7.0 alpha S.u.S.E. Linux 7.0 PHP PHP 4.0.3 pl1 S.u.S.E. Linux 6.4 ppc S.u.S.E. Linux 6.4 i386 S.u.S.E. Linux 6.4 alpha S.u.S.E. Linux 6.4 PHP PHP 4.0.3 Debian Linux 2.2 sparc Debian Linux 2.2 powerpc Debian Linux 2.2 IA32 Debian Linux 2.2 arm Debian Linux 2.2 alpha Debian Linux 2.2 68k Debian Linux 2.2 Sun Cobalt Control Station 4100CS Sun Cobalt Qube3 Japanese 4000WGJ Sun Cobalt Qube3 Japanese w/ Caching and RAID 4100WGJ Sun Cobalt Qube3 Japanese w/Caching 4010WGJ Sun Cobalt RaQ XTR 3500R Sun Cobalt RaQ XTR Japanese 3500Rja PHP PHP 4.0.2 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 pl1 PHP PHP 4.0.1 Sun Cobalt Qube3 4000WG Sun Cobalt Qube3 w/ Caching and RAID 4100WG Sun Cobalt Qube3 w/Caching 4010WG Sun Cobalt RaQ4 3001R Sun Cobalt RaQ4 Japanese RAID 3100Rja Sun Cobalt RaQ4 RAID 3100R PHP PHP 4.0 0 PHP PHP 3.0.18 Conectiva Linux 6.0 Conectiva Linux 5.1 Conectiva Linux 5.0 Conectiva Linux graficas Conectiva Linux ecommerce Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia64 Debian Linux 3.0 ia32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Debian Linux 2.2 sparc Debian Linux 2.2 powerpc Debian Linux 2.2 IA32 Debian Linux 2.2 arm Debian Linux 2.2 alpha Debian Linux 2.2 68k Debian Linux 2.2 RedHat Linux 6.2 sparc RedHat Linux 6.2 i386 RedHat Linux 6.2 alpha RedHat Linux 6.2 Trustix Secure Linux 1.2 Trustix Secure Linux 1.1 PHP PHP 3.0.17 S.u.S.E. Linux 7.1 x86 S.u.S.E. Linux 7.1 sparc S.u.S.E. Linux 7.1 ppc S.u.S.E. Linux 7.1 alpha S.u.S.E. Linux 7.1 S.u.S.E. Linux 7.0 sparc S.u.S.E. Linux 7.0 ppc S.u.S.E. Linux 7.0 i386 S.u.S.E. Linux 7.0 alpha S.u.S.E. Linux 7.0 Trustix Secure Linux 1.2 Trustix Secure Linux 1.1 PHP PHP 3.0.16 PHP PHP 3.0.15 PHP PHP 3.0.14 PHP PHP 3.0.13 PHP PHP 3.0.12 PHP PHP 3.0.11 PHP PHP 3.0.10 PHP PHP 3.0.9 PHP PHP 3.0.8 PHP PHP 3.0.7 Sun 2800 Workgroup NTT/KOBE 2800WGJKOBE PHP PHP 3.0.6 PHP PHP 3.0.5 PHP PHP 3.0.4 PHP PHP 3.0.3 PHP PHP 3.0.2 PHP PHP 3.0.1 PHP PHP 3.0 0 PHP PHP 3.0 .16 S.u.S.E. Linux 6.4 ppc S.u.S.E. Linux 6.4 i386 S.u.S.E. Linux 6.4 alpha S.u.S.E. Linux 6.4 PHP PHP 3.0 .13 PHP PHP 3.0 .12 PHP PHP 3.0 .11 PHP PHP 3.0 .10
Not Vulnerable
Code	Attackers may exploit these issues with standard PHP code. The following proof-of-concept is available: /data/vulnerabilities/exploits/ php-bypass-sept9-2006.php
TXT

Vulnerabilities - newest 10 RSS | More

2009-12-17 Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability
2009-12-17 Winamp Module Decoder Plugin Multiple Buffer Overflow Vulnerabilities
2009-12-17 Winamp JPEG and PNG Multiple Integer Overflow Vulnerabilities
2009-12-17 HP OpenView Storage Data Protector Stack Buffer Overflow Vulnerability
2009-12-17 IBM WebSphere Application Server Feature Pack for CEA Spoofing Vulnerability
2009-12-17 Digital Scribe Cross Site Scripting and SQL Injection Vulnerabilities
2009-12-17 WP-Forum WordPress Plugin Multiple SQL Injection Vulnerabilities
2009-12-17 Quick Heal AntiVirus Insecure Program File Permissions Local Privilege Escalation Vulnerability
2009-12-17 IntelliCom NetBiter webSCADA Multiple Default Password Security Bypass Vulnerabilities
2009-12-17 Webmatic Multiple Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities

exploits , vulnerabilities , articles , PHP Ini_Restore() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability