» Topic:  PHP 5.2.4 Released... unpatched

» Added by:  Maksymilian Arciemowicz

» Date:  4.9.2007

  In 30 August PHP Team have released new version PHP with number 5.2.4. We have tested this version and now we can say, that not all issues from PHP 5.2.3 are patched. It is possible bypass safe_mode, open_basedir and disabled_functions.

Changelog:
--- http://www.php.net/ChangeLog-5.php#5.2.4 ---
Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Stas, Maksymilian Arciemowicz)
--- http://www.php.net/ChangeLog-5.php#5.2.4 ---

but where is fix "mail.force_extra_parameters"? . It is still possible to use exploit from 5.2.3 to execute function by mail() function.

The problem still exist in new php version . We reported PHP Team about this problem and we will be waiting for patch.


CVE-2007-3378 (SREASONRES:20070627):
http://securityreason.com/achievement_securityalert/45

Exploit CVE-2007-3378 for 5.2.3:
http://securityreason.com/achievement_exploitalert/9

Update :

There is possible local Denial of Service attack on PHP 5.2.4 .

Exploit :
http://securityreason.com/exploitalert/2710