PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.
CVSS Details
- CVSS 3.1 Base Score: 7.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Php | — | Upgrade to PHP version 5.2.1 | Oct 1, 2012 | Dec 10, 2006 |
| Suse | — | Upgrade apache-mod_php4Upgrade php5-pgsqlUpgrade php4-mhashUpgrade apache2-mod_php4Upgrade php5-develUpgrade php5-sysvshmUpgrade php4-unixODBCUpgrade php4-sessionUpgrade php5-ldapUpgrade php4-imapUpgrade php5-fastcgiUpgrade php5-imapUpgrade suse-releaseUpgrade php4-fastcgiUpgrade php5-dbaUpgrade php4-wddxUpgrade php5-bcmathUpgrade php5-wddxUpgrade mod_php4-coreUpgrade apache2-mod_php5Upgrade php5-gdUpgrade php5-zipUpgrade php5-mysqlUpgrade php4-develUpgrade php5-odbcUpgrade php5-mbstringUpgrade php5-xmlrpcUpgrade php5-iconvUpgrade php5-ftpUpgrade php5-mhashUpgrade php5-exifUpgrade php4-mysqlUpgrade php5-pearUpgrade php5-curlUpgrade php4-pearUpgrade php4-exifUpgrade php4-sysvshmUpgrade php5-soapUpgrade mod_php4-servletUpgrade php5-sysvmsgUpgrade php5-dom | Feb 17, 2015 | Dec 10, 2006 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub