Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 29 Apr 2014 17:15:48 +0200
From: Christian Hoffmann <>
Subject: Fwd: [vs] php-fpm: privilege escalation due to insecure default config

This is now public.
CVE-2014-0185 has has been assigned to this issue meanwhile.

-------- Original message --------
Betreff: [vs] php-fpm: privilege escalation due to insecure default config
Datum: Tue, 15 Apr 2014 21:49:57 +0200
Von: Christian Hoffmann <>


PHP FPM is the FastCGI Process Manager for PHP which can manage several
pools of PHP FastCGI processors, often running with different user
permissions for privilege separation. Web servers connect to these pools
through one socket per configured process pool.

When using UNIX sockets, the socket's permissions default to 0666 if not
overriden explicitly ("listen.mode"). This is true even if the owner of
the socket is changed explicitly ("listen.user", "").

Depending on the concrete scenario, this may result in privilege escalation.
Any local user with the ability to connect to UNIX sockets can run
arbitrary (PHP) code with the target process pool's permissions [1].

Ubuntu 14.04 Beta's default config seems to be vulnerable, any local
user can run code as the 'www-data' user [2]. Other versions or
distributions have not been tested, but may well be vulnerable, too.

This issue is both about the example config [3] and the actual code [4].

No CVE has been requested by me or the PHP team (AFAIK) so far.

Stanislav Malyshev from the PHP team has prepared a patch [5], which
will be part of php-5.4.28.

This issue is not public yet. Suggested embargo date: 2014-04-29

References (some still marked private at the time of writing):


Kind regards,

Christian Hoffmann

Download attachment "signature.asc" of type "application/pgp-signature" (885 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.