1. Ubuntu Security Notices
  2. USN-207-1

USN-207-1: PHP vulnerability

Publication date

17 October 2005

Overview

PHP vulnerability

Releases

Details

A bug has been found in the handling of the open_basedir directive
handling. Contrary to the specification, the value of open_basedir
was handled as a prefix instead of a proper directory name even if it
was terminated by a slash (‘/’). For example, this allowed PHP scripts
to access the directory /home/user10 when open_basedir was configured
to ‘/home/user1/’.

A bug has been found in the handling of the open_basedir directive
handling. Contrary to the specification, the value of open_basedir
was handled as a prefix instead of a proper directory name even if it
was terminated by a slash (‘/’). For example, this allowed PHP scripts
to access the directory /home/user10 when open_basedir was configured
to ‘/home/user1/’.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
5.04 hoary libapache2-mod-php4 – 
libapache-mod-php4 – 
4.10 warty libapache2-mod-php4 – 
libapache-mod-php4 – 

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›