OSVDB ID: 36866

Title: PHP Session File Symlink open_basedir Restriction Bypass

Info

Disclosure

Aug 30, 2007

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Unknown or Incomplete

Classification

Location: Local Access Required
Attack Type: Race Condition

Solution

Upgrade to version 5.2.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

CVE ID: 2007-4652 (see also: NVD)
Secunia Advisory ID: 26642 26748 26802 26838 27102 27110 27377
ISS X-Force ID: 36387
Related OSVDB ID: 36858 36859 36861 36863 36864 36865 36867 36869 36870
FrSIRT Advisory: ADV-2007-3023
Other Advisory URL: http://lists.rpath.com/pipermail/security-announce/2007-October/000269.html
http://lists.rpath.com/pipermail/security-announce/2007-September/000244.html
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware- ......
http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
http://www.php.net/releases/5_2_4.php
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00321.h ......
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.h ......
Vendor URL: http://www.php.net/
Vendor Specific News/Changelog Entry: http://www.php.net/ChangeLog-5.php#5.2.4
http://www.php.net/releases/5_2_4.php

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218