Re: Security of suphp

[Bernd Wurst <bernd () bwurst org>]

Hi.

Am Sonntag, 19. Juni 2005 20:41 schrieb Andrew Griffiths:
> There is the below issue:
> http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-08/
> 0321.html

This is interesting, but I don't fully understand the issue here.
Let's say you have a "regular" apache webserver with mod_php, mod_suphp 
and CGI configured to run via SuExec for every user.

So an attacker can possibly use some image gallery or things like that 
to upload malicious code to the server and (in the worst case) into the 
document root. This can be done either you use mod_php or suphp or any 
kind of CGI script. 
However, to perform the exploit mentioned, the webserver's user 
(www-data) must execute /usr/sbin/suphp with the desired environment.

And that's the point where I think the advisory is not an issue!

The advisory states that one can execute /usr/sbin/suphp through 
mod_php, because that one's running the PHP scripts as www-data user. 
But if you have such a configuration (mod_php), you MUST use safe_mode, 
because if you don't, every user ca read every other user's web 
directory, containing e.g. MySQL passwords etc.
So if mod_php runs in safe_mode, a script is not allowed to run user 
defined executables, but only those one residing in safe_mode_exec_dir.

Am I wrong or what do you folks think about this? If one uses safe_mode 
for mod_php and SuExec for CGI scripts, is the combination of mod_php 
and mod_suphp secure?

cu, Bernd

-- 
The hardness of the butter is proportional to the softness of the bread.

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/