----------------------------------------------------------------------

Want to join the Secunia Security Team?

Secunia offers a position as a security specialist, where your daily
work involves reverse engineering of software and exploit code,
auditing of source code, and analysis of vulnerability reports.

http://secunia.com/secunia_security_specialist/

----------------------------------------------------------------------

TITLE:
PHP "error_log()" Safe Mode Bypass Weakness

SECUNIA ADVISORY ID:
SA20818

VERIFY ADVISORY:
http://secunia.com/advisories/20818/

CRITICAL:
Not critical

IMPACT:
Security Bypass

WHERE:
Local system

SOFTWARE:
PHP 4.4.x
http://secunia.com/product/5768/
PHP 5.1.x
http://secunia.com/product/6796/

DESCRIPTION:
Maksymilian Arciemowicz has discovered a weakness in PHP, which can
be exploited by malicious, local users to bypass certain security
restrictions.

The weakness is caused due to an input validation error in the
"error_log()" PHP function in the processing of the destination
parameter. This can be exploited to bypass the safe mode protection
via directory traversal attacks in the "php://" wrapper.

The weakness has been confirmed in version 5.1.4 and has also been
reported in version 4.4.2. Other versions may also be affected.

SOLUTION:
Do not solely rely on the safe mode protection to protect against
malicious PHP scripts.

Disable the "error_log" function via the "disable_functions"
directive if the safe mode protection is required. This may affect
functionality.

PROVIDED AND/OR DISCOVERED BY:
Maksymilian Arciemowicz

ORIGINAL ADVISORY:
http://securityreason.com/achievement_securityalert/41

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------