CVE

Id
9491  
CVE No.
CVE-2004-1063  
Status
Candidate  
Description
PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended safe_mode_exec_dir via shell metacharacters in the current directory name. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.  
Phase
Assigned (20041123)  
Votes
REVIEWING(1) Christey  
Comments
Christey> There is active disagreement regarding whether this satisfies the | criteria for inclusion in CVE, because the attack vectors require | function parameters that are typically controlled only by the | application developer, not an external attacker. This would mean that | only the PHP application owner could exploit it. | | Since various PHP functions already allow the application owner to | execute commands, no additional privileges would be gained by | exploiting such a bug. However, if safe_mode is enabled in PHP, then | the PHP functions related to execution are restricted | (e.g. shell_exec()). Thus, exploitation may allow the PHP application | owner to execute code *despite* the configured restrictions imposed by | safe mode, which then qualifies this as a vulnerability.  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
63901 9491 CVE-2004-1063 BUGTRAQ:20041215 Advisory 01/2004: Multiple vulnerabilities in PHP 4/5  View
63902 9491 CVE-2004-1063 URL:http://www.securityfocus.com/archive/1/384545  View
63903 9491 CVE-2004-1063 MISC:http://www.hardened-php.net/advisories/012004.txt  View
63904 9491 CVE-2004-1063 CONFIRM:http://www.php.net/release_4_3_10.php  View
63905 9491 CVE-2004-1063 CONECTIVA:CLA-2005:915  View
63906 9491 CVE-2004-1063 URL:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915  View
63907 9491 CVE-2004-1063 GENTOO:GLSA-200412-14  View
63908 9491 CVE-2004-1063 URL:http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml  View
63909 9491 CVE-2004-1063 HP:HPSBMA01212  View
63910 9491 CVE-2004-1063 URL:http://www.securityfocus.com/advisories/9028  View
63911 9491 CVE-2004-1063 MANDRAKE:MDKSA-2004:151  View
63912 9491 CVE-2004-1063 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2004:151  View
63913 9491 CVE-2004-1063 MANDRAKE:MDKSA-2005:072  View
63914 9491 CVE-2004-1063 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2005:072  View
63915 9491 CVE-2004-1063 UBUNTU:USN-99-1  View
63916 9491 CVE-2004-1063 URL:https://www.ubuntu.com/usn/usn-99-1/  View
63917 9491 CVE-2004-1063 BID:11964  View
63918 9491 CVE-2004-1063 URL:http://www.securityfocus.com/bid/11964  View
63919 9491 CVE-2004-1063 OSVDB:12412  View
63920 9491 CVE-2004-1063 URL:http://www.osvdb.org/12412  View
63921 9491 CVE-2004-1063 XF:php-safemodeexecdir-restriction-bypass(18511)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63200 JVNDB-2004-000542 PHP の realpath() 関数におけるファイルパス長の制限を回避される脆弱性 ------------ CVE-2004-1064 9491 10 http://jvndb.jvn.jp/ja/contents/2004/JVNDB-2004-000542.html  View