TITLE:
PHP "phpinfo()" Cross-Site Scripting and Security Bypass

SECUNIA ADVISORY ID:
SA19599

VERIFY ADVISORY:
http://secunia.com/advisories/19599/

CRITICAL:
Not critical

IMPACT:
Security Bypass, Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
PHP 4.0.x
http://secunia.com/product/1655/
PHP 4.1.x
http://secunia.com/product/1654/
PHP 4.2.x
http://secunia.com/product/105/
PHP 4.3.x
http://secunia.com/product/922/
PHP 4.4.x
http://secunia.com/product/5768/
PHP 5.0.x
http://secunia.com/product/3919/
PHP 5.1.x
http://secunia.com/product/6796/

DESCRIPTION:
Maksymilian Arciemowicz has reported some vulnerabilities in PHP,
which can be exploited by malicious, local users to bypass certain
security restrictions and by malicious people to conduct cross-site
scripting attacks.

1) The "phpinfo()" PHP function only sanitises the first 4096
characters of an array request parameter before it is returned to
users. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site via a
script calling "phpinfo()".

2) An error in the "tempnam()" PHP function can be exploited to
bypass the "open_basedir" directive and create temporary files in
arbitrary directories via directory traversal attacks.

3) An error in the "copy()" PHP function can be exploited to bypass
the safe mode protection mechanism and access files outside the
"open_basedir" root via the "compress.zlib://" file wrapper.

The vulnerabilities have been reported in versions 4.4.2 and 5.1.2,
and prior.

SOLUTION:
The vulnerabilities have been fixed in the CVS repository.

PHP scripts calling "phpinfo()" should not be publicly accessible on
production systems.

PROVIDED AND/OR DISCOVERED BY:
Maksymilian Arciemowicz

ORIGINAL ADVISORY:
http://securityreason.com/achievement_securityalert/34
http://securityreason.com/achievement_securityalert/36
http://securityreason.com/achievement_securityalert/37

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------