ID CVE-2006-5178
Summary Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink.
References
Vulnerable Configurations
  • PHP 4.0.0
    cpe:2.3:a:php:php:4.0
  • PHP PHP 4.0.1
    cpe:2.3:a:php:php:4.0.1
  • cpe:2.3:a:php:php:4.0.1:patch1
    cpe:2.3:a:php:php:4.0.1:patch1
  • cpe:2.3:a:php:php:4.0.1:patch2
    cpe:2.3:a:php:php:4.0.1:patch2
  • PHP PHP 4.0.2
    cpe:2.3:a:php:php:4.0.2
  • cpe:2.3:a:php:php:4.0.3:patch1
    cpe:2.3:a:php:php:4.0.3:patch1
  • PHP PHP 4.0.4
    cpe:2.3:a:php:php:4.0.4
  • PHP PHP 4.0.5
    cpe:2.3:a:php:php:4.0.5
  • PHP PHP 4.0.6
    cpe:2.3:a:php:php:4.0.6
  • PHP PHP 4.0.7
    cpe:2.3:a:php:php:4.0.7
  • cpe:2.3:a:php:php:4.0.7:rc1
    cpe:2.3:a:php:php:4.0.7:rc1
  • cpe:2.3:a:php:php:4.0.7:rc2
    cpe:2.3:a:php:php:4.0.7:rc2
  • cpe:2.3:a:php:php:4.0.7:rc3
    cpe:2.3:a:php:php:4.0.7:rc3
  • PHP PHP 4.1.0
    cpe:2.3:a:php:php:4.1.0
  • PHP PHP 4.1.1
    cpe:2.3:a:php:php:4.1.1
  • PHP PHP 4.1.2
    cpe:2.3:a:php:php:4.1.2
  • cpe:2.3:a:php:php:4.2:-:dev
    cpe:2.3:a:php:php:4.2:-:dev
  • PHP PHP 4.2.0
    cpe:2.3:a:php:php:4.2.0
  • PHP PHP 4.2.1
    cpe:2.3:a:php:php:4.2.1
  • PHP PHP 4.2.2
    cpe:2.3:a:php:php:4.2.2
  • PHP PHP 4.2.3
    cpe:2.3:a:php:php:4.2.3
  • PHP PHP 4.3.0
    cpe:2.3:a:php:php:4.3.0
  • PHP PHP 4.3.1
    cpe:2.3:a:php:php:4.3.1
  • PHP PHP 4.3.2
    cpe:2.3:a:php:php:4.3.2
  • PHP PHP 4.3.3
    cpe:2.3:a:php:php:4.3.3
  • PHP PHP 4.3.4
    cpe:2.3:a:php:php:4.3.4
  • PHP PHP 4.3.5
    cpe:2.3:a:php:php:4.3.5
  • PHP PHP 4.3.6
    cpe:2.3:a:php:php:4.3.6
  • PHP PHP 4.3.7
    cpe:2.3:a:php:php:4.3.7
  • PHP PHP 4.3.8
    cpe:2.3:a:php:php:4.3.8
  • PHP PHP 4.3.9
    cpe:2.3:a:php:php:4.3.9
  • PHP PHP 4.3.10
    cpe:2.3:a:php:php:4.3.10
  • PHP PHP 4.3.11
    cpe:2.3:a:php:php:4.3.11
  • PHP PHP 4.4.0
    cpe:2.3:a:php:php:4.4.0
  • PHP PHP 4.4.1
    cpe:2.3:a:php:php:4.4.1
  • PHP PHP 4.4.2
    cpe:2.3:a:php:php:4.4.2
  • PHP PHP 4.4.3
    cpe:2.3:a:php:php:4.4.3
  • PHP PHP 4.4.4
    cpe:2.3:a:php:php:4.4.4
  • cpe:2.3:a:php:php:5.0:rc1
    cpe:2.3:a:php:php:5.0:rc1
  • cpe:2.3:a:php:php:5.0:rc2
    cpe:2.3:a:php:php:5.0:rc2
  • cpe:2.3:a:php:php:5.0:rc3
    cpe:2.3:a:php:php:5.0:rc3
  • PHP PHP 5.0.0
    cpe:2.3:a:php:php:5.0.0
  • PHP PHP 5.0.1
    cpe:2.3:a:php:php:5.0.1
  • PHP PHP 5.0.2
    cpe:2.3:a:php:php:5.0.2
  • PHP PHP 5.0.3
    cpe:2.3:a:php:php:5.0.3
  • PHP PHP 5.0.4
    cpe:2.3:a:php:php:5.0.4
  • PHP PHP 5.0.5
    cpe:2.3:a:php:php:5.0.5
  • PHP PHP 5.1.0
    cpe:2.3:a:php:php:5.1.0
  • PHP PHP 5.1.1
    cpe:2.3:a:php:php:5.1.1
  • PHP PHP 5.1.2
    cpe:2.3:a:php:php:5.1.2
  • PHP PHP 5.1.3
    cpe:2.3:a:php:php:5.1.3
  • PHP 5.1.4
    cpe:2.3:a:php:php:5.1.4
  • PHP PHP 5.1.5
    cpe:2.3:a:php:php:5.1.5
  • PHP PHP 5.1.6
    cpe:2.3:a:php:php:5.1.6
CVSS
Base: 6.2 (as of 10-10-2006 - 12:28)
Impact:
Exploitability:
CWE CWE-362
CAPEC
  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
    This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.
Access
VectorComplexityAuthentication
LOCAL HIGH NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
exploit-db via4
description PHP 5.2.12/5.3.1 symlink() open_basedir bypass. CVE-2006-5178,CVE-2007-4652. Local exploit for php platform
id EDB-ID:10557
last seen 2016-02-01
modified 2009-12-19
published 2009-12-19
reporter Maksymilian Arciemowicz
source https://www.exploit-db.com/download/10557/
title PHP 5.2.12/5.3.1 symlink open_basedir bypass
nessus via4
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2006-185.NASL
    description PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults. (CVE-2006-4625) A race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink. (CVE-2006-5178) Because the design flaw cannot be solved it is strongly recommended to disable the symlink() function if you are using the open_basedir feature. You can achieve that by adding symlink to the list of disabled functions within your php.ini: disable_functions=...,symlink The updated packages do not alter the system php.ini. Updated packages have been patched to correct the CVE-2006-4625 issue. Users must restart Apache for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 24570
    published 2007-02-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=24570
    title Mandrake Linux Security Advisory : php (MDKSA-2006:185)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_EDABE438542F11DBA5AE00508D6A62DF.NASL
    description Stefan Esser reports : PHP's open_basedir feature is meant to disallow scripts to access files outside a set of configured base directories. The checks for this are placed within PHP functions dealing with files before the actual open call is performed. Obviously there is a little span of time between the check and the actual open call. During this time span the checked path could have been altered and point to a file that is forbidden to be accessed due to open_basedir restrictions. Because the open_basedir restrictions often not call PHP functions but 3rd party library functions to actually open the file it is impossible to close this time span in a general way. It would only be possible to close it when PHP handles the actual opening on it's own. While it seems hard to change the path during this little time span it is very simple with the use of the symlink() function combined with a little trick. PHP's symlink() function ensures that source and target of the symlink operation are allowed by open_basedir restrictions (and safe_mode). However it is possible to point a symlink to any file by the use of mkdir(), unlink() and at least two symlinks.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 22504
    published 2006-10-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22504
    title FreeBSD : php -- open_basedir Race Condition Vulnerability (edabe438-542f-11db-a5ae-00508d6a62df)
  • NASL family CGI abuses
    NASL id PHP_SYMLINK_FUNCTION_RACE_CONDITION.NASL
    description According to its banner, the version of PHP installed on the remote host is affected by a security bypass vulnerability. A race condition exists in the symlink function that allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 17717
    published 2011-11-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=17717
    title PHP Symlink Function Race Condition open_basedir Bypass
refmap via4
bid 20326
bugtraq
  • 20061003 Advisory 08/2006: PHP open_basedir Race Condition Vulnerability
  • 20061009 PHP open_basedir with symlink() function Race Condition PoC exploit
fulldisc 20061003 Advisory 08/2006: PHP open_basedir Race Condition Vulnerability
mandriva MDKSA-2006:185
misc
openpkg OpenPKG-SA-2006.023
sectrack 1016977
secunia
  • 22235
  • 22424
sreason 1692
turbo TLSA-2006-38
vupen ADV-2006-3901
xf php-openbasedir-security-bypass(29340)
statements via4
contributor Joshua Bressers
lastmodified 2006-12-04
organization Red Hat
statement We do not consider these to be security issues. For more details see http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php
Last major update 07-03-2011 - 21:42
Published 10-10-2006 - 00:06
Last modified 30-10-2018 - 12:25
Back to Top