PHP 'tempname()' 'safe_mode' Restriction-Bypass Vulnerability

[BJ Dierkes]

http://www.securityfocus.com/bid/36555/

[BJ Dierkes (derks)]

PHP 'tempname()' 'safe_mode' Restriction-Bypass Vulnerability

Bugtraq ID: 36555
Class: Design Error
CVE:
Remote: No
Local: Yes
Published: Sep 30 2009 12:00AM
Updated: Sep 30 2009 08:00PM
Credit: Grzegorz Stachowiak from SecurityReason
Vulnerable: PHP PHP 5.3
PHP PHP 5.2.11

[BJ Dierkes (derks)]

# /[svn]/php/php-src/branches/PHP_5_2/ext/standard/file.c (PHP)
# /[svn]/php/php-src/branches/PHP_5_3/ext/standard/file.c (PHP)
# PHP 5.2.11 tempnam() safe_mode bypass (Security Reason)
# PHP Homepage (PHP)

[BJ Dierkes (derks)]

Packages for php52 and php53 that resolve this vulnerability have been pushed to ius-el5 stable.

======================================================================
Build: php52-5.2.11-2.ius
----------------------------------------------------------------------

Package Description:

PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated webpages.

---

Update Information:

%changelog
- Only install /etc/rpm/macros.pear if building with pear. Resolves
  LaunchPad Bug #448260.
- Added Patch309: php-5.2.11-bug447752.patch resolves LaunchPad Bug
  447752, Security Focus Bugtraq ID 36555 PHP tempname() safe_mode
  Restriction-Bypass Vulnerability

---

References:

 [ 1 ] Bug #447752 - PHP 'tempname()' 'safe_mode' Restriction-Bypass
Vulnerability
       https://bugs.launchpad.net/ius/+bug/447752
 [ 2 ] Bug #448260 - conflict between php53-devel and php53-pear
       https://bugs.launchpad.net/ius/+bug/447752

======================================================================
Build: php53-5.3.0-5.ius
----------------------------------------------------------------------

Package Description:

PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated webpages.

---

Update Information:

%changelog
* Sat Oct 10 2009 BJ Dierkes <email address hidden> - 5.3.0-5.ius
- Only install /etc/rpm/macros.pear if building with pear. Resolves
  LaunchPad Bug #448260.
- Added Patch309: php-5.3.0-bug447752.patch resolves LaunchPad Bug
  447752, Security Focus Bugtraq ID 36555 PHP tempname() safe_mode
  Restriction-Bypass Vulnerability

---

References:

 [ 1 ] Bug #447752 - PHP 'tempname()' 'safe_mode' Restriction-Bypass
Vulnerability
       https://bugs.launchpad.net/ius/+bug/447752
 [ 2 ] Bug #448260 - conflict between php53-devel and php53-pear
       https://bugs.launchpad.net/ius/+bug/447752