|
커피향이 나는 *NIX
커피닉스
시스템/네트웍/보안을 다루는 곳
|
|
|
|
| 이전 주제 보기 :: 다음 주제 보기 |
| 글쓴이 |
메시지 |
truefeel
카페 관리자
가입: 2003년 7월 24일
올린 글: 1277
위치: 대한민국
|
 올려짐: 2004.12.24 금, 11:55 am 주제: PHP 4.3.9 이전 버전의 취약점에 대해 |
 |
|
며칠지난 얘기이기는 하지만 중요한 부분이라....
PHP 4.3.9 이전 버전에 있는 취약점에 대한 것입니다.
워낙 취약한 부분이 많으니 꼭 4.3.10으로 업하시구요,
특히 phpBB 등을 포함한 공개용 php 소스를 사용하는 곳은 꼭꼭 하세요.
PHP 4.3.10으로 업할 때 Zend Optimizer도 사용한다면 꼭 최근의 2.5.7 을 받아서 사용하세요.
프비와 Linux용 모두 있습니다.
http://www.php.net/downloads.php
http://zend.com/store/products/zend-optimizer.php
---------------------------------------------------------------------
http://www.sec-consult.com/146.html
| 인용: |
[16.12.04] PHP Input Validation Vulnerabilities
Date: 12-16-2004
Author: Daniel Fabian
Product: PHP
Vendor: PHP (http://www.php.net)
Vendor-Status: vendor contacted
Vendor-Patches: patched versions have been released
~~~~~~~~
Synopsis
~~~~~~~~~~~~~~~~~~~~~~~~
PHP version 4.3.9 is vulnerable to meta character attacks. The bug could
enable an attacker to read arbitrary files from the filesystem of a
webserver that hosts PHP scripts.
In addition PHP versions 4.3.6 until 4.3.9 as well as PHP versions 5.0.0
until 5.0.2 contain a bug that enables an attacker to manipulate the file
name of uploaded files to perform directory traversal.
While both vulnerabilities exist in windows and unix platform versions of
PHP, they can only be successfully exploited on windows systems.
~~~~~~~~
Vendor Status
~~~~~~~~~~~~~~~~~~~~~~~~
The vendor has been timely informed and has released patched versions of
the software (PHP 4.3.10/PHP 5.0.3). Those can be downloaded from
www.php.net
~~~~~~~~
Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~
addslashes() Vulnerability:
---------------------------
Scope:
PHP version 4.3.9 contains a bug in the function addslashes().
addslashes() can be used to sanitize userinput and render it thus
impossible for an attacker to influence scripts by injection meta
characters. In the default configuration, magic_quotes_gpc is set to "On"
which automagically performs addslashes() on every input value. However
because of a bug, the NULL byte is not correctly encoded by addslashes,
enabling an attacker to read arbitrary files from the file system, if user
input is used within include() or require() directives.
Details:
Addslashes should turn a NULL byte (will be written as %00 in this
advisory) into the string "\0" (backslash zero). In version 4.3.9 the
NULL byte is encoded as "\%00" (backslash null byte). Everything after
the NULL byte is ignored in include and require directives so that an
attacker can truncate the name of the file that is included in the PHP
script. The last character however will always be the backslash. As in
Windows the backslash is the path delimitor, this does not matter - the
file named before the backslash is still loaded.
Example:
Consider the following PHP script:
<?
$whatever = addslashes($_REQUEST['whatever']);
include("/path/to/program/" . $whatever . "/header.htm");
?>
A malicious attacker might open the following URL, disclosing the
boot.ini file:
http: //localhost/phpscript.php?whatever=../../../../boot.ini%00
The trailing backslash from the escaped \%00 does for some reason not seem
to be of concern to include().
Upload Path Traversion Vulnerability:
-------------------------------------
Scope:
PHP automatically sanitizes the file name of uploaded files removing
everything before the last slash or backslash. This is done in order to
prevent path traversal attacks with uploaded files. However if an attacker
uploads a file containing a single quote and the attacked web server has
magic_quotes turned on (which is default configuration) or performs an
addslashes() directive on the name of the uploaded file, the quote is
prefixed with a backslash. This occurs after PHP checks for backslashes in
the filename. As the backslash is the path delimitor in windows, this
behavior enables an attacker to traverse the path by one directory level.
Example:
If a file with the name "..'file.ext" is uploaded, PHP turns the name to
"..\'file.ext" and the file is uploaded to the directory below of where
the PHP script copies it.
~~~~~~~~
Counter Measures
~~~~~~~~~~~~~~~~~~~~~~~~
Upgrade to PHP version 4.3.10, respectively 5.0.3.
~~~~~~~~
Timeline
~~~~~~~~~~~~~~~~~~~~~~~~
Oct. 08: Notified vendor of addslashes vulnerability
Oct. 14: Vendor reply
Nov. 02: Notified vendor of upload vulnerability
Nov. 04: Vendor reply
Nov. 20: Problems fixed in CVS
Dec. 14: Release of patched versions 4.3.10/5.0.3
EOF Daniel Fabian / @2004
d.fabian at sec-consult dot com
~~~~~~~~
Contact
~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH
Buro Wien
Blindengasse 3
A-1080 Wien
Austria
Tel.: +43 / 1 / 409 0307 - 570
Fax.: +43 / 1 / 409 0307 - 590
Mail: office at sec-consult dot com
www.sec-consult.com
|
http://www.hardened-php.net/advisories/012004.txt
| 인용: |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hardened-PHP Project
www.hardened-php.net
-= Security Advisory =-
Advisory: Multiple vulnerabilities within PHP 4/5
Release Date: 2004/12/15
Last Modified: 2004/12/15
Author: Stefan Esser [sesser@php.net]
Application: PHP4 <= 4.3.9
PHP5 <= 5.0.2
Severity: Several vulnerabilities within PHP allow
local and remote execution of arbitrary code
Risk: Critical
Vendor Status: Vendor has released bugfixed versions.
References: http://www.hardened-php.net/advisories/012004.txt
Overview:
PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.
During the development of Hardened-PHP which adds security hardening
features to the PHP codebase, several vulnerabilities within PHP
were discovered that reach from bufferoverflows, over information
leak vulnerabilities and path truncation vulnerabilities to
safe_mode restriction bypass vulnerabilities.
Details:
[01 - pack() - integer overflow leading to heap bufferoverflow ]
Insufficient validation of the parameters passed to pack() can
lead to a heap overflow which can be used to execute arbitrary
code from within a PHP script. This enables an attacker to
bypass safe_mode restrictions and execute arbitrary code with
the permissions of the webserver. Due to the nature of this
function it is unlikely that a script accidently exposes it to
remote attackers.
[02 - unpack() - integer overflow leading to heap info leak ]
Insufficient validation of the parameters passed to unpack() can
lead to a heap information leak which can be used to retrieve
secret data from the apache process. Additionally a skilled
local attacker could use this vulnerability in combination with
01 to bypass heap canary protection systems. Similiar to 01 this
function is usually not used on user supplied data within
webapplications.
[03 - safe_mode_exec_dir bypass in multithreaded PHP ]
When safe_mode is activated within PHP, it is only allowed to
execute commands within the configured safe_mode_exec_dir.
Unfourtunately PHP does prepend a "cd [currentdir] ;" to any
executed command when a PHP is running on a multithreaded unix
webserver (f.e. some installations of Apache2). Because the name
of the current directory is prepended directly a local attacker
may bypass safe_mode_exec_dir restrictions by injecting shell-
commands into the current directory name.
[04 - safe_mode bypass through path truncation ]
The safe_mode checks silently truncated the file path at MAXPATHLEN
bytes before passing it to realpath(). In combination with certain
malfunctional implementations of realpath() f.e. within glibc this
allows crafting a filepath that pass the safe_mode check although
it points to a file that should fail the safe_mode check.
[05 - path truncation in realpath() ]
PHP uses realpath() within several places to get the real path
of files. Unfourtunately some implementations of realpath() silently
truncate overlong filenames (f.e. OpenBSD, and older NetBSD/FreeBSD)
This can lead to arbitrary file include vulnerabilities if something
like "include "modules/$userinput/config.inc.php"; is used on such
systems.
[06 - unserialize() - wrong handling of negative references ]
The variable unserializer could be fooled with negative references
to add false zvalues to hashtables. When those hashtables get
destroyed this can lead to efree()s of arbitrary memory addresses
which can result in arbitrary code execution. (Unless Hardened-PHP's
memory manager canaries are activated)
[07 - unserialize() - wrong handling of references to freed data ]
Additionally to bug 06 the previous version of the variable
unserializer allowed setting references to already freed entries in
the variable hash. A skilled attacker can exploit this to create
an universal string that will pass execution to an arbitrary
memory address when it is passed to unserialize(). For AMD64 systems
it was even possible to developed a string that directly passes
execution to shellcode contained in the string itself.
It is necessary to understand that these strings can exploit a
bunch of popular PHP applications remotely because they pass f.e.
cookie content to unserialize().
Examples of vulnerable scripts:
- phpBB2
- Invision Board
- vBulletin
- Woltlab Burning Board 2.x
- Serendipity Weblog
- phpAds(New)
- ...
Proof of Concept:
The Hardened-PHP project is not going to release exploits for any
of these vulnerabilities to the public.
CVE Information:
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-1018 to issues 01, 02, the name
CAN-2004-1019 to issues 06, 07, the name CAN-2004-1063 to issue 03
and the name CAN-2004-1064 to issues 04, 05.
Recommendation:
It is strongly recommended to upgrade to the new PHP-Releases as
soon as possible, because a lot of PHP applications expose the
easy to exploit unserialize() vulnerability to remote attackers.
Additionally we always recommend to run PHP with the Hardened-PHP
patch applied.
GPG-Key:
http://www.hardened-php.net/hardened-php-signature-key.asc
pub 1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key
Key fingerprint = 066F A6D0 E57E 9936 9082 7E52 4439 14CC 0A86 4AA1
Copyright 2004 Stefan Esser. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFBwIzIRDkUzAqGSqERArD/AKCqerfjCYJnZ2vy7tRYth3VqWmqhwCbB+LL
s12EomCQ0IstWmz3F/QhM8E=
=21xF
-----END PGP SIGNATURE-----
|
|
|
| 위로 |
|
 |
|
|
새로운 주제를 올릴 수 있습니다
답글을 올릴 수 있습니다
주제를 수정할 수 없습니다
올린 글을 삭제할 수 없습니다
투표를 할 수 없습니다
|
Powered by phpBB © 2001, 2005 phpBB Group
|
FAQ
검색
멤버리스트
사용자 그룹
사용자 등록하기
개인 정보
비공개 메시지를 확인하려면 로그인하십시오
로그인
가입없이 누구나 글을 쓸 수 있습니다. 공지사항에 대한 댓글까지도..
BBS >>
설치, 운영 Q&A |
네트웍, 보안 Q&A |
일반 Q&A ||
정보마당 |
AWS ||
자유게시판 |
구인구직 ||
공지사항 |
의견제시
