Re: [PHP-DEV] Pretty mammoth security issue with safe_mode_exec From: Adam Wright (adam <email protected>)
Date: 01/05/01

Woops, best ignore this patch. The bug is real, but this (untested :) patch
is fubar

adamw

----- Original Message -----
From: "Adam Wright" <adam <email protected>>
To: "PHP Development" <php-dev <email protected>>
Cc: <zeev <email protected>>
Sent: Friday, January 05, 2001 12:11 PM
Subject: [PHP-DEV] Pretty mammoth security issue with safe_mode_exec

> If you have safe mode enabled, and have a safe mode exec directory, here's
> how you can execute binarys outside of your safe mode exec directory!
>
> Normally...
>
> system("../../../../../bin/cp blah blip");
>
> would fail (as .. is blocked in _Exec (standard/exec.c)
>
> However...
>
> system("\.\./\.\./\.\./\.\./\.\./bin/cp blah blip");
>
> will work fine! This is because the .. check was performed before the
> php_escape_shell_cmd in exec.c!
>
> --We fixed it, and our PHP *still* compiles :)
>
> (untested patch for exec.c attached)
>
> adamw
> adam <email protected>
>
>
>
>

---------------------------------------------------------------------------- 

----

> --
> PHP Development Mailing List <http://www.php.net/>
> To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
> For additional commands, e-mail: php-dev-help <email protected>
> To contact the list administrators, e-mail: php-list-admin <email protected>

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>