+++ This bug was initially created as a clone of Bug #195538 +++ tempnam() unique filename bypass Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename. In order for this issue to be exploited, a user application would have to use tempnam() in manner which would allow an attacker to control the filename.
The "attack" described here to pass a long path to the php_do_open_temporary_file function, which will force the snprintf() call to truncate the path printed to the fixed length buffer (of size MAXPATHLEN). The 'XXXXXX' characters would then be omitted from the path passed to mkstemp. The aim being that the mkstemp call would then create a file with an extension under the control of the "attacker" and hence possibly an executable PHP script, rather than with the unique suffix. But the glibc mkstemp() implementation will fail if the passed-in path does not include the trailing "six Xs"; in that case php_open_temporary_* will fall back on using the sytem-wide temp dir rather than the user-supplied one. In any case, the "open_basedir" feature does not implement a reliable security barrier between script and environment, so script authors must be trusted with privileges of the "apache" user anyway.