| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <56A64663.1020406@search-lab.hu> Date: Mon, 25 Jan 2016 16:59:31 +0100 From: Imre RAD <imre.rad@...rch-lab.hu> To: fulldisclosure@...lists.org Subject: [FD] PHP LiteSpeed SAPI secret key improper disposal In suEXEC_Daemon mode of the LiteSpeed web server spawns one PHP master process during startup. It is running as root and accepts LSAPI requests, which in turn specify what user under the script should run. The LSAPI request is authenticated with a MAC, which is based on preshared random key between the the PHP and the web server. We found, the Litespeed PHP SAPI module did not clear this secret in its child processes so it was available in the PHP process memory space of the child processes. The fix is available with the commit https://github.com/php/php-src/commit/c60d4b97707c513ee8b554eecf1c5c653cae5998#diff-19cd0c042863b5e723b785a39a866a25 The fixed versions of PHP are: 5.5.31, 5.6.17 and 7.0.2. More information: http://www.search-lab.hu/about-us/news/111-some-unusual-vulnerabilities-in-the-php-engine Imre Rad Search-Lab Ltd. http://www.search-lab.hu/ http://www.scademy.com/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists