Re: CVE-2014-6271: remote code execution through bash

[Florian Weimer <fweimer () redhat com>]

On 09/24/2014 07:03 PM, Hanno Böck wrote:
> On Wed, 24 Sep 2014 18:30:35 +0200
> Florian Weimer <fweimer () redhat com> wrote:
>
> > This depends on how PHP is invoked.  mod_php does not set the CGI
> > environment variables.
> >
> > However, it is true that if CGI programs spawn subprocesses, they may
> > be affected even if the CGI program itself is not written in bash.
>
> Regarding php, isn't it quite common to run it through mod_fcgid with a
> (bash) wrapper script? At least that's what apache wiki documents:
> https://wiki.apache.org/httpd/php-fcgid

I don't know what's common with PHP.  I don't think there is much public 
documentation about what it takes to run PHP at scale in a secure 
fashion (also taking compromised or downright malicious customers into 
account).

> So that'd mean many php installations are affected even if they don't
> use subprocesses.
>
> I'm not sure if this wrapper can be avoided.

The wrapper does not run per request.  I have not tested this, but I 
don't think it sees any request-specific environment variables at this 
point.  FCGI transfers request information over a socket at descriptor 0 
and not through environment variables.

--
Florian Weimer / Red Hat Product Security