[PHP-DEV] Pretty mammoth security issue with safe_mode_exec From: Adam Wright (adam <email protected>)
Date: 01/05/01

If you have safe mode enabled, and have a safe mode exec directory, here's
how you can execute binarys outside of your safe mode exec directory!

Normally...

system("../../../../../bin/cp blah blip");

would fail (as .. is blocked in _Exec (standard/exec.c)

However...

system("\.\./\.\./\.\./\.\./\.\./bin/cp blah blip");

will work fine! This is because the .. check was performed before the
php_escape_shell_cmd in exec.c!

--We fixed it, and our PHP *still* compiles :)

(untested patch for exec.c attached)

adamw
adam <email protected> 

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>