Bugtraq mailing list archives
Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload
From: Eygene Ryabinkin <rea-sec () codelabs ru>
Date: Mon, 8 Dec 2008 16:47:36 +0300
Maksymilian, Mon, Dec 08, 2008 at 02:14:36PM +0100, Maksymilian Arciemowicz wrote:
Sat, Dec 06, 2008 at 12:40:48PM -0700, cxib () securityreason com wrote:[ SecurityReason.com : PHP 5.2.6 SAPI php_getuid() overload ][...]Using PHP 5.2.6, as a Apache module can bypass many security points.Am I right that this vulnerability exists only in the Apache 1.x flavour of the PHP module? The code in question that sets SG(server_context) too late and initializes BG variable after the .htaccess processing exists only in sapi/apache/mod_php5.c. For Apache 2.x module the handler is 'php_handler', it lives in apache2{filter,handler}/sapi_apache2.c and BG/SG(server_context) are initialized before .htaccess processing.yes BG(page_uid)=BG(page_gid)=0 should be -1 so php_getuid() will return 0. tested on apache 13 20 22
Yes, sorry: I missed the 'AllowOverride All' for my 2.2 testbed. Once again, sorry for the confusion: the issue is here for 2.x too. -- Eygene
Current thread:
- SecurityReason: PHP 5.2.6 SAPI php_getuid() overload cxib (Dec 06)
- Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload Eygene Ryabinkin (Dec 08)
- Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload Maksymilian Arciemowicz (Dec 08)
- Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload Eygene Ryabinkin (Dec 08)
- Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload Maksymilian Arciemowicz (Dec 08)
- Re: SecurityReason: PHP 5.2.6 SAPI php_getuid() overload Eygene Ryabinkin (Dec 08)