IUS Community Project

PHP 'posix_mkfifo()' 'open_basedir' Restriction Bypass Vulnerability

Bug #462057 reported by BJ Dierkes
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
IUS Community Project
Fix Released
High
BJ Dierkes

Bug Description

http://www.securityfocus.com/bid/36554/info

Bugtraq ID: 36554
Class: Design Error
CVE:
Remote: No
Local: Yes
Published: Sep 30 2009 12:00AM
Updated: Sep 30 2009 08:00PM
Credit: Grzegorz Stachowiak
Vulnerable: PHP PHP 5.3
PHP PHP 5.2.11

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/posix/posix.c?view=log
http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/posix/posix.c?view=log

http://securityreason.com/securityalert/6600

BJ Dierkes (derks)
visibility: private → public
Changed in ius:
status: New → In Progress
Revision history for this message
BJ Dierkes (derks) wrote :

Upstream CVS fix backported to php52-5.2.10-3.ius

Revision history for this message
BJ Dierkes (derks) wrote :

Upstream CVS fix backported to php53-5.3.0-7.ius

Revision history for this message
BJ Dierkes (derks) wrote :

Reproduced issue based on the example from securityreason.com, verified that issue is fixed with latest versions of php52/php53.

Revision history for this message
BJ Dierkes (derks) wrote :

Fixes pushed to ius-el5 stable, and ius-el4 stable (php52 only)

Changed in ius:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.