Date: Tue, 29 Apr 2014 17:15:48 +0200 From: Christian Hoffmann <christian@...fie.info> To: oss-security@...ts.openwall.com Subject: Fwd: [vs] php-fpm: privilege escalation due to insecure default config (CVE-2014-0185) This is now public. CVE-2014-0185 has has been assigned to this issue meanwhile. -------- Original message -------- Betreff: [vs] php-fpm: privilege escalation due to insecure default config Datum: Tue, 15 Apr 2014 21:49:57 +0200 Von: Christian Hoffmann <mail@...fmann-christian.info> An: distros@...openwall.org Hi, PHP FPM is the FastCGI Process Manager for PHP which can manage several pools of PHP FastCGI processors, often running with different user permissions for privilege separation. Web servers connect to these pools through one socket per configured process pool. When using UNIX sockets, the socket's permissions default to 0666 if not overriden explicitly ("listen.mode"). This is true even if the owner of the socket is changed explicitly ("listen.user", "listen.group"). Depending on the concrete scenario, this may result in privilege escalation. Any local user with the ability to connect to UNIX sockets can run arbitrary (PHP) code with the target process pool's permissions . Ubuntu 14.04 Beta's default config seems to be vulnerable, any local user can run code as the 'www-data' user . Other versions or distributions have not been tested, but may well be vulnerable, too. This issue is both about the example config  and the actual code . No CVE has been requested by me or the PHP team (AFAIK) so far. Stanislav Malyshev from the PHP team has prepared a patch , which will be part of php-5.4.28. This issue is not public yet. Suggested embargo date: 2014-04-29 References (some still marked private at the time of writing):  https://bugs.php.net/bug.php?id=67060  https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1307027  https://github.com/php/php-src/blob/php-5.5.11/sapi/fpm/php-fpm.conf.in#L172  https://github.com/php/php-src/blob/php-5.5.11/sapi/fpm/fpm/fpm_unix.c#L31  https://hoffmann-christian.info/files/php-fpm/0001-Fix-bug-67060-use-default-mode-of-660.patch Kind regards, Christian Hoffmann [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ