-----BEGIN PGP SIGNED MESSAGE-----=0D
Hash: SHA1=0D
=0D
[ SecurityReason.com PHP 5.2.6 dba_replace() destroying file ]=0D
=0D
Author: Maksymilian Arciemowicz=0D
http://securityreason.com=0D 
Date:=0D
- - Written: 10.11.2008=0D
- - Public: 28.11.2008=0D
=0D
SecurityReason Research=0D
SecurityAlert Id: 58=0D
SecurityRisk: Medium=0D
=0D
Affected Software: PHP 5.2.6=0D
Advisory URL: http://securityreason.com/achievement_securityalert/58=0D 
Vendor: http://www.php.net=0D 
=0D
- --- 0.Description ---=0D
PHP is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web developers to write dynamically generated pages quickly.=0D
=0D
NOTE:=0D
These functions build the foundation for accessing Berkeley DB style databases. =0D
=0D
dba_replace - Replace or insert entry=0D
=0D
- --- 1. dba_replace() destroying file ---=0D
Function dba_replace() are not filtring strings key and value. There is a possibility the destruction of the file.=0D
=0D
# cat /www/dba.hack.php=0D
=0D
# cat /www/about.ini=0D
PATH=/=0D
CURR=.=0D
HOME=/home/=0D
# php /www/dba.hack.php=0D
# cat /www/about.ini=0D
PATH=/=0D
CURR=.=0D
HOME=/www/=0D
#=0D
=0D
Well.=0D
But, lets try use=0D
=0D
# cat /www/dba.ham.php=0D
=0D
# php /www/dba.ham.php=0D
# cat /www/about.ini=0D
#=0D
=0D
Now /www/about.ini, is emtpy.  =0D
=0D
- --- 2. How to fix ---=0D
Fixed in CVS=0D
=0D
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1313&r2=1.2027.2.547.2.1314&=0D 
=0D
- --- 3. Greets ---=0D
sp3x p_e_a Infospec schain =0D
=0D
- --- 4. Contact ---=0D
Author: SecurityReason [ Maksymilian Arciemowicz ]=0D
Email: cxib [ a t] securityreason [d ot ] com=0D
GPG: http://securityreason.pl/key/Arciemowicz.Maksymilian.gpg=0D 
http://securityreason.com=0D 
http://securityreason.pl=0D 
-----BEGIN PGP SIGNATURE-----=0D
Version: GnuPG v1.4.9 (OpenBSD)=0D
=0D
iEYEARECAAYFAkkvKDcACgkQpiCeOKaYa9aRUgCgmsbU4uKeq1E+/yyIlQas9V14=0D
e2MAoJobXQNRD8BNiDsHQYSNdOxIyQRc=0D
=Tb8r=0D
-----END PGP SIGNATURE-----=0D