Attachment 27493 Details for Bug 63635

discussion about the broken patch

joey (text/plain), 11.57 KB, created by Ludwig Nussel on 2005-01-10 17:47:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-01-10 17:47:49 UTC

Size: 11.57 KB

patch

obsolete

>From vendor-sec-admin@lst.de  Wed Dec 22 19:49:55 2004
>Return-Path: <vendor-sec-admin@lst.de>
>X-Original-To: lnussel@wotan.suse.de
>Received: from hermes.suse.de (hermes.suse.de [149.44.160.1])
>	by wotan.suse.de (Postfix) with ESMTP id 13D4111D28C
>	for <lnussel@wotan.suse.de>; Wed, 22 Dec 2004 19:49:55 +0100 (CET)
>Received: by hermes.suse.de (Postfix)
>	id 083EA11195C; Wed, 22 Dec 2004 19:49:55 +0100 (CET)
>Received: from scanhost.suse.de (scanhost.suse.de [149.44.160.36])
>	by hermes.suse.de (Postfix) with ESMTP
>	id F0E66111954; Wed, 22 Dec 2004 19:49:54 +0100 (CET)
>Received: from hermes.suse.de ([149.44.160.1])
> by scanhost.suse.de (scanhost [149.44.160.36]) (amavisd-new, port 10025)
> with ESMTP id 06019-06; Wed, 22 Dec 2004 19:49:50 +0100 (CET)
>Received: from Cantor.suse.de (ns.suse.de [195.135.220.2])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by hermes.suse.de (Postfix) with ESMTP
>	id 4CB51111946; Wed, 22 Dec 2004 19:49:50 +0100 (CET)
>Received: from mail.lst.de (verein.lst.de [213.95.11.210])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by Cantor.suse.de (Postfix) with ESMTP id 226C01259456;
>	Wed, 22 Dec 2004 19:49:50 +0100 (CET)
>Received: from verein.lst.de (localhost [127.0.0.1])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id iBMImI6s022563;
>	Wed, 22 Dec 2004 19:48:18 +0100
>Received: from luonnotar.infodrom.org (luonnotar.infodrom.org [195.124.48.78])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id iBMIlB6s022519
>	for <vendor-sec@lst.de>; Wed, 22 Dec 2004 19:47:11 +0100
>Received: by luonnotar.infodrom.org (Postfix, from userid 10)
>	id 38F4D366B8C; Wed, 22 Dec 2004 19:47:14 +0100 (CET)
>Received: at Infodrom Oldenburg (/\##/\ Smail-3.2.0.102 1998-Aug-2 #2)
>	from infodrom.org by finlandia.Infodrom.North.DE
>	via smail from stdin
>	id <m1ChBPi-000ohCC@finlandia.Infodrom.North.DE>
>	for vendor-sec@lst.de; Wed, 22 Dec 2004 19:40:46 +0100 (CET) 
>From: Martin Schulze <joey@infodrom.org>
>To: Stefan Esser <sesser@suspekt.org>
>Cc: vendor-sec@lst.de, security@php.net
>Message-ID: <20041222184046.GA26930@finlandia.infodrom.north.de>
>References: <41A9D40B.8040100@suspekt.org> <0411281529210.22321@dell1.moose.awe.com> <20041130170913.GA9789@redhat.com> <0412031005300.29716@dell1.moose.awe.com> <41B04A8A.4060109@suspekt.org>
>Mime-Version: 1.0
>Content-Type: text/plain; charset=iso-8859-1
>Content-Disposition: inline
>In-Reply-To: <41B04A8A.4060109@suspekt.org>
>User-Agent: Mutt/1.5.6+20040907i
>Subject: [vendor-sec] Re: PHP: Multiple vulnerabilities
>Sender: vendor-sec-admin@lst.de
>Errors-To: vendor-sec-admin@lst.de
>X-BeenThere: vendor-sec@lst.de
>X-Mailman-Version: 2.0.11
>Precedence: bulk
>List-Help: <mailto:vendor-sec-request@lst.de?subject=help>
>List-Post: <mailto:vendor-sec@lst.de>
>List-Subscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=subscribe>
>List-Id: <vendor-sec.lst.de>
>List-Unsubscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=unsubscribe>
>List-Archive: <https://www.lst.de/cgi-bin/mailman/private/vendor-sec/>
>X-Original-Date: Wed, 22 Dec 2004 19:40:46 +0100
>Date: Wed, 22 Dec 2004 19:40:46 +0100
>X-Virus-Scanned: by amavisd-new at scanhost.suse.de
>X-Spam-Status: No, hits=0.0 tagged_above=-20.0 required=5.0 tests=
>X-Spam-Level: 
>Status: RO
>Content-Length: 3656
>Lines: 101
>
>Stefan Esser wrote:
>> [08] TSRM/tsrm_virtual_cwd.c - virtual_popen() safe_mode_exec_dir bypass
>> 
>> When PHP is running multithreaded (f.e. multithreaded apache2, 
>> roxen-zts, ...) popen() automaticly gets a "cd CURRENTDIR ; " prepended. 
>> This happens directly before execution and after all checks. This means 
>> a script could create a directory with shellcommands in its name and 
>> execute them. Even if safe_mode_exec_dir is set to something like 
>> "/wont/ever/execute/anything/because/this/dir/does/not/exist"
>> 
>> http://cvs.php.net/diff.php/TSRM/tsrm_virtual_cwd.c?r1=1.41.2.7&r2=1.41.2.8&ty=h
>> 
>> Credits: Stefan Esser
>
>I have a question about the referenced patch:
>
>===================================================================
>RCS file: /repository/TSRM/tsrm_virtual_cwd.c,v
>retrieving revision 1.41.2.7
>retrieving revision 1.41.2.8
>diff -p --unified=3 -r1.41.2.7 -r1.41.2.8
>--- tsrm_virtual_cwd.c  2004/12/02 00:44:33     1.41.2.7
>+++ tsrm_virtual_cwd.c  2004/12/02 01:04:46     1.41.2.8
>@@ -17,7 +17,7 @@
>    +----------------------------------------------------------------------+
> */
>
>-/* $Id: tsrm_virtual_cwd.c,v 1.41.2.7 2004/12/02 00:44:33 sesser Exp $ */
>+/* $Id: tsrm_virtual_cwd.c,v 1.41.2.8 2004/12/02 01:04:46 sesser Exp $ */
>
> #include <sys/types.h>
> #include <sys/stat.h>
>@@ -835,13 +835,24 @@ CWD_API FILE *virtual_popen(const char *
> CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC)
> {
>        int command_length;
>+       int dir_length, extra = 0;
>        char *command_line;
>-       char *ptr;
>+       char *ptr, *dir;
>        FILE *retval;
>
>        command_length = strlen(command);
>
>-       ptr = command_line = (char *) malloc(command_length + sizeof("cd  ; ") + CWDG(cwd).cwd_length+1);
>+       dir_length = CWDG(cwd).cwd_length;
>+       dir = CWDG(cwd).cwd;
>+       while (dir_length > 0) {
>+               if (*dir == '\'') extra+=3;
>+               dir++;
>+               dir_length--;
>+       }
>+       dir_length = CWDG(cwd).cwd_length;
>+       dir = CWDG(cwd).cwd;
>+
>+       ptr = command_line = (char *) malloc(command_length + sizeof("cd '' ; ") + dir_length +1+1);
>        if (!command_line) {
>                return NULL;
>        }
>@@ -851,8 +862,21 @@ CWD_API FILE *virtual_popen(const char *
>        if (CWDG(cwd).cwd_length == 0) {
>                *ptr++ = DEFAULT_SLASH;
>        } else {
>-               memcpy(ptr, CWDG(cwd).cwd, CWDG(cwd).cwd_length);
>-               ptr += CWDG(cwd).cwd_length;
>+               *ptr++ = '\'';
>+               while (dir_length > 0) {
>+                       switch (*dir) {
>+                       case '\'':
>+                               *ptr++ = '\'';
>+                               *ptr++ = '\\';
>+                               *ptr++ = '\'';
>+                               /* fall-through */
>+                       default:
>+                               *ptr++ = *dir;
>+                       }
>+                       dir++;
>+                       dir_length--;
>+               }
>+               *ptr++ = '\'';
>        }
>
>        *ptr++ = ' ';
>
>The extra variable doesn't seem to be used except to count additional
>space requirements.  It is not used afterwards, so there is either no
>need to count additional string space, or there is "+ extra" missing
>in the malloc command from above.  Hence, doesn't the above code write
>over the end of the allocated area?
>
>Regards,
>
>	Joey
>
>-- 
>All language designers are arrogant.  Goes with the territory...
>	-- Larry Wall
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From vendor-sec-admin@lst.de  Wed Dec 22 20:03:01 2004
>Return-Path: <vendor-sec-admin@lst.de>
>X-Original-To: lnussel@wotan.suse.de
>Received: from hermes.suse.de (hermes.suse.de [149.44.160.1])
>	by wotan.suse.de (Postfix) with ESMTP id BAC9EF3D96
>	for <lnussel@wotan.suse.de>; Wed, 22 Dec 2004 20:03:01 +0100 (CET)
>Received: by hermes.suse.de (Postfix)
>	id AC60211137F; Wed, 22 Dec 2004 20:03:01 +0100 (CET)
>Received: from scanhost.suse.de (scanhost.suse.de [149.44.160.36])
>	by hermes.suse.de (Postfix) with ESMTP
>	id A063610FFDF; Wed, 22 Dec 2004 20:03:01 +0100 (CET)
>Received: from hermes.suse.de ([149.44.160.1])
> by scanhost.suse.de (scanhost [149.44.160.36]) (amavisd-new, port 10025)
> with ESMTP id 09498-16; Wed, 22 Dec 2004 20:02:59 +0100 (CET)
>Received: from Cantor.suse.de (mail-ex.suse.de [195.135.220.2])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by hermes.suse.de (Postfix) with ESMTP
>	id 4BE44111154; Wed, 22 Dec 2004 20:02:59 +0100 (CET)
>Received: from mail.lst.de (verein.lst.de [213.95.11.210])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by Cantor.suse.de (Postfix) with ESMTP id 1F45012595C2;
>	Wed, 22 Dec 2004 20:02:59 +0100 (CET)
>Received: from verein.lst.de (localhost [127.0.0.1])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id iBMJ2B6s022969;
>	Wed, 22 Dec 2004 20:02:11 +0100
>Received: from e-matters.de (hermes.e-matters.de [217.69.76.213])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with SMTP id iBMJ1I6s022948
>	for <vendor-sec@lst.de>; Wed, 22 Dec 2004 20:01:18 +0100
>Received: (qmail 30638 invoked by uid 0); 22 Dec 2004 18:58:04 -0000
>Received: from p548753ec.dip.t-dialin.net (HELO ?192.168.1.77?) (84.135.83.236)
>  by /var/run/qmail-smtp.pid with SMTP; 22 Dec 2004 18:58:04 -0000
>Message-ID: <41C9C476.80701@php.net>
>From: Stefan Esser <sesser@php.net>
>User-Agent: Mozilla Thunderbird 0.9 (Windows/20041103)
>X-Accept-Language: en-us, en
>MIME-Version: 1.0
>To: Martin Schulze <joey@infodrom.org>
>Cc: Stefan Esser <sesser@suspekt.org>, vendor-sec@lst.de,
>	security@php.net
>References: <41A9D40B.8040100@suspekt.org> <0411281529210.22321@dell1.moose.awe.com> <20041130170913.GA9789@redhat.com> <0412031005300.29716@dell1.moose.awe.com> <41B04A8A.4060109@suspekt.org> <20041222184046.GA26930@finlandia.infodrom.north.de>
>In-Reply-To: <20041222184046.GA26930@finlandia.infodrom.north.de>
>Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>Content-Transfer-Encoding: 7bit
>Subject: [vendor-sec] Re: PHP: Multiple vulnerabilities
>Sender: vendor-sec-admin@lst.de
>Errors-To: vendor-sec-admin@lst.de
>X-BeenThere: vendor-sec@lst.de
>X-Mailman-Version: 2.0.11
>Precedence: bulk
>List-Help: <mailto:vendor-sec-request@lst.de?subject=help>
>List-Post: <mailto:vendor-sec@lst.de>
>List-Subscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=subscribe>
>List-Id: <vendor-sec.lst.de>
>List-Unsubscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=unsubscribe>
>List-Archive: <https://www.lst.de/cgi-bin/mailman/private/vendor-sec/>
>X-Original-Date: Wed, 22 Dec 2004 20:01:10 +0100
>Date: Wed, 22 Dec 2004 20:01:10 +0100
>X-Virus-Scanned: by amavisd-new at scanhost.suse.de
>X-Spam-Status: No, hits=-0.1 tagged_above=-20.0 required=5.0
> tests=LOCAL_RCVD_FROM_TONLINE
>X-Spam-Level: 
>Status: RO
>X-Status: A
>Content-Length: 1244
>Lines: 27
>
>Ohhhhh....
>
>> The extra variable doesn't seem to be used except to count additional
>> space requirements.  It is not used afterwards, so there is either no
>> need to count additional string space, or there is "+ extra" missing
>> in the malloc command from above.  Hence, doesn't the above code write
>> over the end of the allocated area?
>
>It seems you are right. The situation that allowed arbitrary shell 
>command execution in the last version does now overflow the buffer.
>
>Stefan
>
>-- 
>--------------------------------------------------------------------------
>  Stefan Esser                                        s.esser@e-matters.de
>  e-matters Security                         http://security.e-matters.de/
>
>  GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0x15ABDA78
>  Key fingerprint       7806 58C8 CFA8 CE4A 1C2C  57DD 4AE1 795E 15AB DA78
>--------------------------------------------------------------------------
>  Did I help you? Consider a gift:            http://wishlist.suspekt.org/
>--------------------------------------------------------------------------
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>

Actions: View

Attachments on bug 63635: 27493