I'm trying to get PCI compliant and the PCI scanning company is flagging our Ubuntu 12.04.3 (PHP 5.3.10-1ubuntu3.8) for CVE-2013-1635  which says "we do not support the use of open_basedir". What exactly is meant by that? I still see references to the both directives in the php.ini file and the PCI company is saying that Canonical has not "addressed" the issue. Any suggestions?
The sample config file for php has a more detailed explanation:
; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server configuration file. This directive is ; *NOT* affected by whether Safe Mode is turned On or Off. ; NOTE: this is considered a "broken" security measure. ; Applications relying on this feature will not recieve full ; support by the security team. For more information please ; see /usr/share/doc/php5-common/README.Debian.security
If you are not using the open_basedir feature, the vulnerability will not affect you and is of no concern. Just as the "password bruteforce" vulnerability would not affect you if you have sufficiently secure user passwords.
Note that other security teams also have decided "not to address" this issue as the open_basedir directive is not considered to be a properly implemented security feature:
This bug will be used as a meta-bug for tracking PHP "safe"-mode/open_basedir issues, which will in general not be fixed in updates for Red Hat Enterprise Linux of the PHP package.
The openbase_dir can cause issues and security vulnerabilities specifically when bugs have been report and they need to be fixed. You should comment out this directive in php.ini or consider some other operating system as this is ubuntu specific issue. I suggest you better use centOS. Consult your developer if this directive is not required better comment it out in php.ini.