Re: Apache Exploit

[Jefferson Ogata <seclists () antibozo net>]

Michal Zalewski wrote:
> This is not to say that delivering signals is not the way to exploit
> problems like that - conditions that would otherwise lead directly to SEGV
> because of access to non-allocated memory, for example. Quite
> (un)fortunately, there are only two signals that could be perhaps
> delivered to Apache (which, keep in mind, is running as a standalone
> daemon) - SIGPIPE and SIGURG - that is, if they are not ignored and if the
> handler does something interesting, which I'm not so sure about (but
> haven't looked in a while).

Seems to me SIGTERM is likely as well, though it may not happen until someone 
reboots the webserver. SIGCHLD is also a possibility if an external CGI is 
involved, no?

--
Jefferson Ogata : Internetworker, Antibozo
<ogata () antibozo net>  http://www.antibozo.net/ogata/
whois: jo317/whois.networksolutions.com
http://www.antibozo.net/ogata/pgp.asc