bugtraq - Re: SecurityReason: PHP 5.2.6 SAPI php

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <REgd3r0TFgmK/BeL3kQXz4zNIX0@kjaK+/sQ5DW5981v71UogZJPf/0>
Date: Mon, 8 Dec 2008 16:47:36 +0300
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: Maksymilian Arciemowicz <cxib@...urityreason.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload

Maksymilian,

Mon, Dec 08, 2008 at 02:14:36PM +0100, Maksymilian Arciemowicz wrote:
> > Sat, Dec 06, 2008 at 12:40:48PM -0700, cxib@...urityreason.com wrote:
> >> [ SecurityReason.com : PHP 5.2.6 SAPI php_getuid() overload ]
> > [...]
> >> Using PHP 5.2.6, as a Apache module can bypass many security points.
> > 
> > Am I right that this vulnerability exists only in the Apache 1.x flavour
> > of the PHP module?  The code in question that sets SG(server_context)
> > too late and initializes BG variable after the .htaccess processing
> > exists only in sapi/apache/mod_php5.c.  For Apache 2.x module the
> > handler is 'php_handler', it lives in apache2{filter,handler}/sapi_apache2.c
> > and BG/SG(server_context) are initialized before .htaccess processing.
> 
> yes
> 
> BG(page_uid)=BG(page_gid)=0
> 
> should be -1
> 
> so
> 
> php_getuid() will return 0.
> 
> tested on apache 13 20 22

Yes, sorry: I missed the 'AllowOverride All' for my 2.2 testbed.

Once again, sorry for the confusion: the issue is here for 2.x too.
-- 
Eygene