full-disclosure - Security of suphp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200506201443.11217@bwurst.org>
Date: Mon Jun 20 13:43:19 2005
From: bernd at bwurst.org (Bernd Wurst)
Subject: Security of suphp

Hi.

Am Sonntag, 19. Juni 2005 20:41 schrieb Andrew Griffiths:
> There is the below issue:
> http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-08/
>0321.html

This is interesting, but I don't fully understand the issue here.
Let's say you have a "regular" apache webserver with mod_php, mod_suphp 
and CGI configured to run via SuExec for every user.

So an attacker can possibly use some image gallery or things like that 
to upload malicious code to the server and (in the worst case) into the 
document root. This can be done either you use mod_php or suphp or any 
kind of CGI script. 
However, to perform the exploit mentioned, the webserver's user 
(www-data) must execute /usr/sbin/suphp with the desired environment.

And that's the point where I think the advisory is not an issue!

The advisory states that one can execute /usr/sbin/suphp through 
mod_php, because that one's running the PHP scripts as www-data user. 
But if you have such a configuration (mod_php), you MUST use safe_mode, 
because if you don't, every user ca read every other user's web 
directory, containing e.g. MySQL passwords etc.
So if mod_php runs in safe_mode, a script is not allowed to run user 
defined executables, but only those one residing in safe_mode_exec_dir.

Am I wrong or what do you folks think about this? If one uses safe_mode 
for mod_php and SuExec for CGI scripts, is the combination of mod_php 
and mod_suphp secure?

cu, Bernd

-- 
The hardness of the butter is proportional to the softness of the bread.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 827 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050620/821c04fc/attachment.bin