bugtraq - Re: Hijacking Apache 2 via mod

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 22 Jan 2004 10:04:00 -0800 (PST)
From: Steve G <linux_4ever@...oo.com>
To: "André" Malo <nd@...lig.de>, 3APA3A <3APA3A@...URITY.NNOV.RU>
Cc: Ben Laurie <ben@...roup.co.uk>,
	Steve Grubb <linux_4ever@...oo.com>, bugtraq@...urityfocus.com,
	httpd security <security@...pd.apache.org>
Subject: Re: Hijacking Apache 2 via mod_perl

>Then one just writes a perl extension in C. Who's responsible 
>then? 

But don't you need root to add extentions?

>Who's responsible if you just write a C module which hijacks the
>descriptors? 

Again, you need an admin to update apache's config.

>Where do you draw the line?

I would think apache should have a safe and defined interface
between itself and modules. I cannot possibly think of any file
descriptor besides 0, 1, &2 that a module would need. The logs
should be stderr, the module should open a descriptor itself, or
apache have an API just for that purpose.

Xinetd, stunnel, and sshd can all run completely untrusted
applications without leaking their listening descriptor. Why
can't apache? Its not just mod_perl, mod_php leaks the https
descriptor, too.

-Steve Grubb

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/