ID de Prueba:	1.3.6.1.4.1.25623.1.0.900184
Categoría:	Web application abuses
Título:	PHP Security Bypass and File Writing Vulnerabilities (Dec 2008)
Resumen:	PHP is prone to a security bypass and a file writing; vulnerability.
Descripción:	Summary: PHP is prone to a security bypass and a file writing vulnerability. Vulnerability Insight: The following flaws exist: - CVE-2008-5624: Error in initialization of 'page_uid' and 'page_gid' global variables for use by the SAPI 'php_getuid' function, which bypass the safe_mode restrictions. - CVE-2008-5625: 'error_log' safe_mode restrictions are not enforced when 'safe_mode' is enabled through a 'php_admin_flag' setting in 'httpd.conf' file. - CVE-2008-5658: Directory traversal vulnerability in 'ZipArchive::extractTo' function which allows attacker to write files via a ZIP file. Vulnerability Impact: Successful exploitation could allow remote attackers to write arbitrary file, bypass security restrictions and cause directory traversal attacks. Affected Software/OS: PHP versions 5.x prior to 5.2.7. Solution: Update to version 5.2.7 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2008-5624 BugTraq ID: 32688 http://www.securityfocus.com/bid/32688 Bugtraq: 20081206 SecurityReason: PHP 5.2.6 SAPI php_getuid() overload (Google Search) http://www.securityfocus.com/archive/1/498985/100/0/threaded Bugtraq: 20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl (Google Search) http://www.securityfocus.com/archive/1/501376/100/0/threaded Debian Security Information: DSA-1789 (Google Search) http://www.debian.org/security/2009/dsa-1789 HPdes Security Advisory: HPSBUX02431 http://marc.info/?l=bugtraq&m=124654546101607&w=2 HPdes Security Advisory: HPSBUX02465 http://marc.info/?l=bugtraq&m=125631037611762&w=2 HPdes Security Advisory: SSRT090085 HPdes Security Advisory: SSRT090192 http://www.mandriva.com/security/advisories?name=MDVSA-2009:045 http://osvdb.org/50483 http://osvdb.org/52207 http://secunia.com/advisories/35003 http://secunia.com/advisories/35650 http://securityreason.com/achievement_securityalert/59 XForce ISS Database: php-getuid-safemode-bypass(47318) https://exchange.xforce.ibmcloud.com/vulnerabilities/47318 Common Vulnerability Exposure (CVE) ID: CVE-2008-5625 BugTraq ID: 32383 http://www.securityfocus.com/bid/32383 Bugtraq: 20081120 SecurityReason : PHP 5.2.6 (error_log) safe_mode bypass (Google Search) http://archives.neohapsis.com/archives/bugtraq/2008-11/0152.html https://www.exploit-db.com/exploits/7171 http://osvdb.org/52205 http://securityreason.com/achievement_securityalert/57 XForce ISS Database: php-error-safemode-bypass(47314) https://exchange.xforce.ibmcloud.com/vulnerabilities/47314 Common Vulnerability Exposure (CVE) ID: CVE-2008-5658 BugTraq ID: 32625 http://www.securityfocus.com/bid/32625 Bugtraq: 20081204 Advisory 06/2008: PHP ZipArchive::extractTo() Directory Traversal Vulnerability (Google Search) http://archives.neohapsis.com/archives/bugtraq/2008-12/0039.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html http://www.sektioneins.de/advisories/SE-2008-06.txt http://www.openwall.com/lists/oss-security/2008/12/04/3 http://osvdb.org/50480 http://www.redhat.com/support/errata/RHSA-2009-0350.html http://www.securitytracker.com/id?1021303 http://secunia.com/advisories/35306 SuSE Security Announcement: SUSE-SR:2009:004 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html XForce ISS Database: php-ziparchive-directory-traversal(47079) https://exchange.xforce.ibmcloud.com/vulnerabilities/47079
Copyright	Copyright (C) 2008 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.