Hi. Am Sonntag, 19. Juni 2005 20:41 schrieb Andrew Griffiths: > There is the below issue: > http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-08/ >0321.html This is interesting, but I don't fully understand the issue here. Let's say you have a "regular" apache webserver with mod_php, mod_suphp and CGI configured to run via SuExec for every user. So an attacker can possibly use some image gallery or things like that to upload malicious code to the server and (in the worst case) into the document root. This can be done either you use mod_php or suphp or any kind of CGI script. However, to perform the exploit mentioned, the webserver's user (www-data) must execute /usr/sbin/suphp with the desired environment. And that's the point where I think the advisory is not an issue! The advisory states that one can execute /usr/sbin/suphp through mod_php, because that one's running the PHP scripts as www-data user. But if you have such a configuration (mod_php), you MUST use safe_mode, because if you don't, every user ca read every other user's web directory, containing e.g. MySQL passwords etc. So if mod_php runs in safe_mode, a script is not allowed to run user defined executables, but only those one residing in safe_mode_exec_dir. Am I wrong or what do you folks think about this? If one uses safe_mode for mod_php and SuExec for CGI scripts, is the combination of mod_php and mod_suphp secure? cu, Bernd -- The hardness of the butter is proportional to the softness of the bread.
Attachment:
pgp2USQ8gkCCI.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/