[<prev] [next>] [day] [month] [year] [list]
Message-ID: <535FC224.3000800@hoffie.info>
Date: Tue, 29 Apr 2014 17:15:48 +0200
From: Christian Hoffmann <christian@...fie.info>
To: oss-security@...ts.openwall.com
Subject: Fwd: [vs] php-fpm: privilege escalation due to insecure default config
(CVE-2014-0185)
This is now public.
CVE-2014-0185 has has been assigned to this issue meanwhile.
-------- Original message --------
Betreff: [vs] php-fpm: privilege escalation due to insecure default config
Datum: Tue, 15 Apr 2014 21:49:57 +0200
Von: Christian Hoffmann <mail@...fmann-christian.info>
An: distros@...openwall.org
Hi,
PHP FPM is the FastCGI Process Manager for PHP which can manage several
pools of PHP FastCGI processors, often running with different user
permissions for privilege separation. Web servers connect to these pools
through one socket per configured process pool.
When using UNIX sockets, the socket's permissions default to 0666 if not
overriden explicitly ("listen.mode"). This is true even if the owner of
the socket is changed explicitly ("listen.user", "listen.group").
Depending on the concrete scenario, this may result in privilege escalation.
Any local user with the ability to connect to UNIX sockets can run
arbitrary (PHP) code with the target process pool's permissions [1].
Ubuntu 14.04 Beta's default config seems to be vulnerable, any local
user can run code as the 'www-data' user [2]. Other versions or
distributions have not been tested, but may well be vulnerable, too.
This issue is both about the example config [3] and the actual code [4].
No CVE has been requested by me or the PHP team (AFAIK) so far.
Stanislav Malyshev from the PHP team has prepared a patch [5], which
will be part of php-5.4.28.
This issue is not public yet. Suggested embargo date: 2014-04-29
References (some still marked private at the time of writing):
[1] https://bugs.php.net/bug.php?id=67060
[2] https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1307027
[3]
https://github.com/php/php-src/blob/php-5.5.11/sapi/fpm/php-fpm.conf.in#L172
[4]
https://github.com/php/php-src/blob/php-5.5.11/sapi/fpm/fpm/fpm_unix.c#L31
[5]
https://hoffmann-christian.info/files/php-fpm/0001-Fix-bug-67060-use-default-mode-of-660.patch
Kind regards,
Christian Hoffmann
Download attachment "signature.asc" of type "application/pgp-signature" (885 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
