Re: Re: Pretty mammoth security issue with safe_mode_exec

99.9999% sure. Try it and see. adamw ----- Original Message ----- From: "Zeev Suraski" <zeev@zend.com> To: "Adam Wright" <adam@elysium.ltd.uk> Cc: "PHP Development" <php-dev@lists.php.net> Sent: Friday, January 05, 2001 12:42 PM Subject: [PHP-DEV] Re: Pretty mammoth security issue with safe_mode_exec > At 14:11 5/1/2001, Adam Wright wrote: > >If you have safe mode enabled, and have a safe mode exec directory, here's > >how you can execute binarys outside of your safe mode exec directory! > > > >Normally... > > > >system("../../../../../bin/cp blah blip"); > > > >would fail (as .. is blocked in _Exec (standard/exec.c) > > > >However... > > > >system("\.\./\.\./\.\./\.\./\.\./bin/cp blah blip"); > > > >will work fine! This is because the .. check was performed before the > >php_escape_shell_cmd in exec.c! > > That's very very odd, because as far as system() (or any function for that > matter) is concerned, ".." and "\.\." is exactly the same thing. At the > scanner level, all the way down in the Zend Engine, it converts the bogus > "\.\." string (which has illegal escapes) to "..". > > Are you sure this is the symptom exactly? > > Zeev > > > -- > Zeev Suraski <zeev@zend.com> > CTO & co-founder, Zend Technologies Ltd. > http://www.zend.com/ > > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > For additional commands, e-mail: php-dev-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > >