oss-sec mailing list archives
Fwd: [vs] php-fpm: privilege escalation due to insecure default config (CVE-2014-0185)
From: Christian Hoffmann <christian () hoffie info>
Date: Tue, 29 Apr 2014 17:15:48 +0200
This is now public. CVE-2014-0185 has has been assigned to this issue meanwhile. -------- Original message -------- Betreff: [vs] php-fpm: privilege escalation due to insecure default config Datum: Tue, 15 Apr 2014 21:49:57 +0200 Von: Christian Hoffmann <mail () hoffmann-christian info> An: distros () vs openwall org Hi, PHP FPM is the FastCGI Process Manager for PHP which can manage several pools of PHP FastCGI processors, often running with different user permissions for privilege separation. Web servers connect to these pools through one socket per configured process pool. When using UNIX sockets, the socket's permissions default to 0666 if not overriden explicitly ("listen.mode"). This is true even if the owner of the socket is changed explicitly ("listen.user", "listen.group"). Depending on the concrete scenario, this may result in privilege escalation. Any local user with the ability to connect to UNIX sockets can run arbitrary (PHP) code with the target process pool's permissions [1]. Ubuntu 14.04 Beta's default config seems to be vulnerable, any local user can run code as the 'www-data' user [2]. Other versions or distributions have not been tested, but may well be vulnerable, too. This issue is both about the example config [3] and the actual code [4]. No CVE has been requested by me or the PHP team (AFAIK) so far. Stanislav Malyshev from the PHP team has prepared a patch [5], which will be part of php-5.4.28. This issue is not public yet. Suggested embargo date: 2014-04-29 References (some still marked private at the time of writing): [1] https://bugs.php.net/bug.php?id=67060 [2] https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1307027 [3] https://github.com/php/php-src/blob/php-5.5.11/sapi/fpm/php-fpm.conf.in#L172 [4] https://github.com/php/php-src/blob/php-5.5.11/sapi/fpm/fpm/fpm_unix.c#L31 [5] https://hoffmann-christian.info/files/php-fpm/0001-Fix-bug-67060-use-default-mode-of-660.patch Kind regards, Christian Hoffmann
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Fwd: [vs] php-fpm: privilege escalation due to insecure default config (CVE-2014-0185) Christian Hoffmann (Apr 29)