[Full-disclosure] copy() Safe Mode Bypass PHP 4.4.2 and 5.1.2

Source: http://securityreason.com/achievementsecurityalert/37 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 copy Safe Mode Bypass PHP 4.4.2 and 5.1.2 Author: Maksymilian Arciemowicz cXIb8O3 Date: - -Written: 2.4.2006 - -Public: 8.4.2006 from SECURITYREASON.COM CVE-2006-1608 - --- 0.Description --...

By the PHP imap function to bypass safe mode and open_basedir restrictions vulnerability thought-the vulnerability of early warning-the black bar safety net

Last night in the green League saw this vulnerability announcement, 2 on 2 8, released, is imapopen of the module exists on the vulnerability, a local attacker could use this vulnerability to unauthorized traversal of the mail directory, illegal create, delete, playback command file. The most...

mb_send_mail() PHP safe mode protection bypass

mbsendmail and imap unfctions allow to access system files...

PHP 4.x5.05.1 with Sendmail Mail Function - additional_param Arbitrary File Creation

PHP 4.x5.05.1 with Sendmail Mail Function - additionalparam Arbitrary File Creation source: https://www.securityfocus.com/bid/16878/info PHP is prone to multiple input-validation vulnerabilities that could allow 'safemode' and 'openbasedir' security settings to be bypassed. These issues reside in...

PHP 4.x/5.0/5.1 with Sendmail Mail Function - 'additional_param' Arbitrary File Creation

source: https://www.securityfocus.com/bid/16878/info PHP is prone to multiple input-validation vulnerabilities that could allow 'safemode' and 'openbasedir' security settings to be bypassed. These issues reside in the 'mbsendmail' function, the 'mail' function, and various PHP IMAP functions...

Microsoft“blocked”online update our“hack”to have surgery-vulnerability warning-the black bar safety net

The Microsoft Windows System vulnerability frequently, in order for the majority of users“responsible for”, Microsoft provide website, online patch update. Who want to make their computer more secure some? Thus are pleased to accept this“free lunch.” But recently found that the update is...

чтение произвольного файла в ODFaq 2.1.0

Программа: ODFaq 2.1.0 http://www.oodie.com/project/odfaq/ Описание: в интерактивной системе ODFaq 2.1.0 существует возможность обхода ограничения на чтение файлов с сервера. В файле config.inc.php в ассоциативном массиве $PAGE прописаны все страницы, доступные для выполнения через параметр P в...

Ubuntu 4.10 : php4 vulnerabilities (USN-66-1)

FraMe from kernelpanik.org reported that the cURL module does not respect openbasedir restrictions. As a result, scripts which used cURL to open files with an user-specified path could read arbitrary local files outside of the openbasedir directory. Stefano Di Paola discovered a vulnerability in...

Ubuntu 4.10 : php4 vulnerabilities (USN-99-2)

USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath function CAN-2004-1064. However, this caused severe regressions, some applications like SquirrelMail a...

Ubuntu 4.10 : php4 vulnerabilities (USN-99-1)

Stefano Di Paola discovered integer overflows in PHP's pack and unpack functions. A malicious PHP script could exploit these to break out of safe mode and execute arbitrary code with the privileges of the PHP interpreter. CAN-2004-1018 Note: The second part of CAN-2004-1018 buffer overflow in the...

security flaw

Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via 1 a negative offset value to the shmopwrite function, 2 an "integer overflow/underflow" in the pack function, or 3 an "integer...

phpMyAdmin remote command execution

The remote web server contains a PHP application that may allow arbitrary command execution. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

GLSA-200510-21 : phpMyAdmin: Local file inclusion and XSS vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200510-21 phpMyAdmin: Local file inclusion and XSS vulnerabilities Stefan Esser discovered that by calling certain PHP files directly, it was possible to workaround the grabglobals.lib.php security model and overwrite the $cfg...

phpMyAdmin: Local file inclusion and XSS vulnerabilities

Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the web. Description Stefan Esser discovered that by calling certain PHP files directly, it was possible to workaround the grabglobals.lib.php security model and overwrite the $cfg configuration...

GLSA-200510-16 : phpMyAdmin: Local file inclusion vulnerability

The remote host is affected by the vulnerability described in GLSA-200510-16 phpMyAdmin: Local file inclusion vulnerability Maksymilian Arciemowicz reported that in libraries/grabglobals.lib.php, the $redirect parameter was not correctly validated. Systems running PHP in safe mode are not affecte...

phpMyAdmin: Local file inclusion vulnerability

Background phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the web. Description Maksymilian Arciemowicz reported that in libraries/grabglobals.lib.php, the $redirect parameter was not correctly validated. Systems running PHP in safe mode are not affected...

php security update

CentOS Errata and Security Advisory CESA-2005:406 Updated PHP packages that fix various security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache...

Mandrake Linux Security Advisory : php (MDKSA-2005:072)

A number of vulnerabilities are addressed in this PHP update : Stefano Di Paolo discovered integer overflows in PHP's pack, unpack, and shmopwrite functions which could allow a malicious script to break out of safe mode and execute arbitrary code with privileges of the PHP interpreter...

USN-99-2: Fixed php4 packages for USN-99-1

USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath function CAN-2004-1064. However, this caused severe regressions, some applications like SquirrelMail a...

USN-99-1: PHP4 vulnerabilities

Stefano Di Paola discovered integer overflows in PHP's pack and unpack functions. A malicious PHP script could exploit these to break out of safe mode and execute arbitrary code with the privileges of the PHP interpreter. CAN-2004-1018 Note: The second part of CAN-2004-1018 buffer overflow in the...