PHP Symlink Function Race Condition open_basedir Bypass

high Nessus Plugin ID 17717

Language:

Synopsis

The remote web server uses a version of PHP that is affected by a security bypass vulnerability.

Description

According to its banner, the version of PHP installed on the remote host is affected by a security bypass vulnerability. A race condition exists in the symlink function that allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions.

Solution

Upgrade to PHP version 5.2.0 or later.

Plugin Details

Severity: High

ID: 17717

File Name: php_symlink_function_race_condition.nasl

Version: 1.10

Type: remote

Family: CGI abuses

Published: 11/18/2011

Updated: 5/31/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2006-5178

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:php:php

Required KB Items: www/PHP, Settings/PCI_DSS, installed_sw/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Patch Publication Date: 11/2/2006

Vulnerability Publication Date: 10/3/2006

Reference Information

CVE: CVE-2006-5178

BID: 20326

CWE: 362

Detections

Analytics