Re: Pretty mammoth security issue with safe_mode_exec

Hmm,. might be best to ignore this for the time being entirely, I'm more inclined to think its a permissions thing with our webserver configuration at the moment. I'll get back to you :) Sorry for the probable misreport, my bad. adamw ----- Original Message ----- From: "Adam Wright" <adam@elysium.ltd.uk> To: "Adam Wright" <adam@elysium.ltd.uk>; "PHP Development" <php-dev@lists.php.net> Cc: <zeev@zend.com> Sent: Friday, January 05, 2001 1:03 PM Subject: Re: [PHP-DEV] Pretty mammoth security issue with safe_mode_exec > Woops, best ignore this patch. The bug is real, but this (untested :) patch > is fubar > > adamw > > ----- Original Message ----- > From: "Adam Wright" <adam@elysium.ltd.uk> > To: "PHP Development" <php-dev@lists.php.net> > Cc: <zeev@zend.com> > Sent: Friday, January 05, 2001 12:11 PM > Subject: [PHP-DEV] Pretty mammoth security issue with safe_mode_exec > > > > If you have safe mode enabled, and have a safe mode exec directory, here's > > how you can execute binarys outside of your safe mode exec directory! > > > > Normally... > > > > system("../../../../../bin/cp blah blip"); > > > > would fail (as .. is blocked in _Exec (standard/exec.c) > > > > However... > > > > system("\.\./\.\./\.\./\.\./\.\./bin/cp blah blip"); > > > > will work fine! This is because the .. check was performed before the > > php_escape_shell_cmd in exec.c! > > > > --We fixed it, and our PHP *still* compiles :) > > > > (untested patch for exec.c attached) > > > > adamw > > adam@elysium.ltd.uk > > > > > > > > > > > -------------------------------------------------------------------------- -- > ---- > > > > -- > > PHP Development Mailing List <http://www.php.net/> > > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > > For additional commands, e-mail: php-dev-help@lists.php.net > > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > For additional commands, e-mail: php-dev-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > >