lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.58.0401232129190.32610@mergle>
Date: Fri, 23 Jan 2004 21:39:34 +0000 (GMT)
From: Matthew Wakeling <mnw21-bugtraq@...pleads.com>
To: Steve G <linux_4ever@...oo.com>
Cc: bugtraq@...urityfocus.com,
	httpd security <security@...pd.apache.org>
Subject: Re: Hijacking Apache 2 via mod_perl



On Thu, 22 Jan 2004, Steve G wrote:
> Xinetd, stunnel, and sshd can all run completely untrusted
> applications without leaking their listening descriptor. Why
> can't apache? Its not just mod_perl, mod_php leaks the https
> descriptor, too.

Xinetd, stunnel, and sshd all run completely untrusted applications by
fork()ing, setuid()ing, removing privileged access, and exec()ing an
entirely new chunk of code. You therefore have a clearly-defined barrier
between the privileged system (sshd) and the program it runs (bash, for
example).

The purpose of mod_perl is to run perl code without having to exec a whole
whacking great perl interpreter every time someone accesses a page.
Therefore, the perl is brought inside the apache process-space, and all
that nasty slow fork() and exec() is got rid of.

A consequence of this is security. The apache process MUST be able to get
hold of those priveleged resources again in time for the next request it
has to handle, otherwise it would have to die have have a new apache
process take its place, which would rather defeat the purpose of bringing
perl in-process in the first place. Therefore, if the apache code is able
to regain priveleges, the perl code can too.

If you want to run untrusted code, don't bring it inside a process that
has privileged access.

Matthew

-- 
[About NP-completeness] These are the problems that make efficient use of
the Fairy Godmother.                    -- Computer Science Lecturer


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ