Introduction:
Because Apache httpd and mod_php are inter-related, Steve does not know if you would consider this an Apache bug or a mod_php bug. Steve has contacted each group and they both blame each other. Personally, Steve does not care whose fault it is so long as it is fixed.
Technical Details:
When using mod_php, many file descriptors are leaked to the PHP script process. If the script page calls external programs by passthru(), exec(), or system(), the descriptors are leaked to that program as well.
One of these descriptors is the listening descriptor to port 443, also known as https. Port 443 is a privileged port and can only be bound to by a root process. It is not normal for that descriptor to be leaked to any or all programs. As a side note, this descriptor seems to be opened by apache regardless of whether or not you use https.
The bug is caused by not making a call to fcntl with the CLOEXEC flag to prevent the leak of a privileged file descriptor.
Impact:
The listening descriptor is used by all sites on the same machine. If a person can ftp in an executable and has access to PHP, they may be able to hijack the https service for all sites on the machine. Sandboxing and jailing may not help since the descriptor itself is leaked to the child.
"Safe_mode = on" does not offer any protection for this problem if safe_mode_exec_dir points to a directory that can be FTP'd to.
Steve also contacted the apache project in August 2002 about this same problem. In October 2002, Steve re-contacted them about leaked descriptors, they confirmed the problem. Feb 2003 the leaked file descriptors were reported by Steve to vuln-dev mail list. The bug was partially fixed in apache 2.0.45. The mod_php vector however is still unfixed.
To see if you are vulnerable, you can use the env_audit program. It comes with directions for testing mod_php in the examples directory http://www.web-insights.net/env_audit.
Exploit:
The technique is simple.
1) Fork and daemonize yourself.
2) Select on the leaked descriptor and start serving pages.
At the end of this advisory is a proof-of-concept program that you can run under mod_php. It is assumed that paying customers can ftp anything they want into their website and mod_php scripting is enabled.
To see the problem first hand, compile the C code:
gcc -o leak-sploit leak-sploit.c -lssl
cp leak-sploit /var/www/html
cp install.php /var/www/html
cp foo-cert.pem /var/www/html
lynx http://localhost/install.php
